Windows Analysis Report
PO] G_24370-24396_SI2_S25_8658.exe

Overview

General Information

Sample name: PO] G_24370-24396_SI2_S25_8658.exe
Analysis ID: 1559143
MD5: adc8d552e00251dbbdcd0aafe5bd3739
SHA1: bdccf1531860ea4e5c139864707332252ca6d62b
SHA256: 0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: PO] G_24370-24396_SI2_S25_8658.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe Avira: detection malicious, Label: HEUR/AGEN.1306899
Found malware configuration
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: PO] G_24370-24396_SI2_S25_8658.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: PO] G_24370-24396_SI2_S25_8658.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: PO] G_24370-24396_SI2_S25_8658.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 4x nop then jmp 07CABD16h 0_2_07CAB5E9
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 4x nop then jmp 07CABD16h 0_2_07CAB69E
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 46.175.148.58 46.175.148.58
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.16:49705 -> 46.175.148.58:25
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: mail.iaa-airferight.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000008.00000002.2477991883.0000000003438000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.iaa-airferight.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1273906340.00000000032CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp, PO] G_24370-24396_SI2_S25_8658.exe, 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, SKTzxzsJw.cs .Net Code: sf6jJs8S
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack, SKTzxzsJw.cs .Net Code: sf6jJs8S

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_018BD51C 0_2_018BD51C
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA2320 0_2_07CA2320
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CACF19 0_2_07CACF19
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA57B8 0_2_07CA57B8
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA5380 0_2_07CA5380
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA72C8 0_2_07CA72C8
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA6028 0_2_07CA6028
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA6027 0_2_07CA6027
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA5BE9 0_2_07CA5BE9
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA5BF0 0_2_07CA5BF0
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 8_2_01A6D0F8 8_2_01A6D0F8
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 8_2_01A6B010 8_2_01A6B010
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 8_2_01A6A3F8 8_2_01A6A3F8
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 8_2_01A6A740 8_2_01A6A740
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 8_2_06972130 8_2_06972130
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 8_2_06973078 8_2_06973078
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 8_2_069754B8 8_2_069754B8
Sample file is different than original file name gathered from version info
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1276526253.0000000005B00000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameArthur.dll" vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1278253591.0000000007FA0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1273906340.00000000032CB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277724023.0000000007BB8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamejaUa.exe6 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1272577083.00000000012EE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1274541036.00000000044D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000000.1225431580.0000000000DF8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamejaUa.exe6 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000008.00000002.2476084613.00000000014F8000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe Binary or memory string: OriginalFilenamejaUa.exe6 vs PO] G_24370-24396_SI2_S25_8658.exe
Uses 32bit PE files
Source: PO] G_24370-24396_SI2_S25_8658.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: PO] G_24370-24396_SI2_S25_8658.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: VxQjXFYhdkY.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, 4JJG6X.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, 4JJG6X.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, 8C78isHTVco.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, 8C78isHTVco.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, 8C78isHTVco.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, 8C78isHTVco.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, CqSP68Ir.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, CqSP68Ir.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, MVfNXuELv1PY47s9c1.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs Security API names: _0020.SetAccessControl
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs Security API names: _0020.AddAccessRule
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, MVfNXuELv1PY47s9c1.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs Security API names: _0020.SetAccessControl
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@13/12@1/1
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File created: C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3860:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6348:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6300:120:WilError_03
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Mutant created: \Sessions\1\BaseNamedObjects\OvgQqnLtifSbE
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File created: C:\Users\user\AppData\Local\Temp\tmpE291.tmp Jump to behavior
Source: PO] G_24370-24396_SI2_S25_8658.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: PO] G_24370-24396_SI2_S25_8658.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File read: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp" Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: PO] G_24370-24396_SI2_S25_8658.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PO] G_24370-24396_SI2_S25_8658.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs .Net Code: D1DV1tIN8q System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs .Net Code: D1DV1tIN8q System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA4783 push es; retf 0_2_07CA4792
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA4774 push es; retf 0_2_07CA4782
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA5368 push ecx; retf 0007h 0_2_07CA536A
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA5282 push es; retf 0_2_07CA5283
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA50C4 push es; retf 0_2_07CA50C5
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA508A push es; retf 0_2_07CA508C
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA509B push es; retf 0_2_07CA50A2
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA5091 push es; retf 0_2_07CA5092
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA50A7 push es; retf 0_2_07CA50A8
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA4F84 push es; retf 0_2_07CA4F8D
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA4F38 push es; retf 0_2_07CA4F39
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA4E33 push es; retf 0_2_07CA4E34
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA4CCB push es; retf 0_2_07CA4CCD
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA4CD2 push es; retf 0_2_07CA4CD3
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA4CFF push es; retf 0_2_07CA4D00
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 0_2_07CA48E3 push cs; retf 0_2_07CA48F2
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 8_2_01A6BFE8 push esp; ret 8_2_01A6BFFD
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 8_2_0697ECB0 push es; ret 8_2_0697ECC0
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Code function: 8_2_06977102 push es; ret 8_2_06977110
Source: PO] G_24370-24396_SI2_S25_8658.exe Static PE information: section name: .text entropy: 7.933918976784444
Source: VxQjXFYhdkY.exe.0.dr Static PE information: section name: .text entropy: 7.933918976784444
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, vtch46YO90XtOrUTp9.cs High entropy of concatenated method names: 'l2qmXtvHfV', 'JxOmOVUmWn', 'UgLmjGJHWY', 'hHpmGf2Dgr', 'PCFmWhVOZO', 'YcImw3KJ11', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, d77XqbcqvedpqQSLRG.cs High entropy of concatenated method names: 'o3CjonacIU', 'EYTjpSflXD', 'HUDj1Q5tg7', 'hVEjh89L7w', 'zWEjL84VmL', 'IstjK62vxE', 'R9njuWXLHW', 'hE2j3iA6rW', 'cGpuhpkdfDXbeohtfBv', 'KiyEqOkDY1S8dEGVp8U'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, i8TCGSzhIFNXFrCaNb.cs High entropy of concatenated method names: 'I3gmLX4Iu7', 'Kx8mEZCHok', 'bHgmuANhHv', 'LMkmRnbXPX', 'QhjmUQdsEc', 'wAJmcOQSPM', 'GlQmvx1yRt', 'WZ5moWX6yG', 'bo4mpJNXWW', 'BjPmyhnvPG'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, BVJ8we3yZQ2puFy4KA.cs High entropy of concatenated method names: 'LR7OAgRJMQ', 'E4uOKsdhwB', 'xMfXF6hhqP', 'bNVXcujqKB', 'y51XvBGgd8', 'rGOXauVi5Y', 'AP9Xf0toTt', 'IUCX9xI4bB', 'MfUXMWPyrA', 'BWZX6R8f2x'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, xi93dHxsxDMH8omRsiw.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'GchmBd2OYj', 'DfFmbFcQCt', 'm0Tm4T8Maa', 'wHomISaRPc', 'zY0mrPLfnI', 'tYomNbXQMg', 'yuKmSfoDfs'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, hCgUrr0eFkI5XY0P4W.cs High entropy of concatenated method names: 'GtfWkICWTb', 'KbaWQsQ1WL', 'bKOWWyIr2V', 'bHqWiuKl20', 'GjQWgQxmVm', 'sgJWoH2lKj', 'Dispose', 'gFBlnoE5lJ', 'lWQlqlc2Ym', 'KZKlXkO7gQ'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, qhJWnR4EwQykKKej0S.cs High entropy of concatenated method names: 'HDDJEG1Qqf', 'dxmJuVbn9l', 'vPkJR0D1vH', 'LN2JUNSBER', 'tdtJcyWOgh', 'TtMJvj6EYF', 'ddMJfHLlx2', 'udWJ9EJniF', 'Q1jJ6YUiyc', 'KvUJBA3Sqk'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, blHjFhtXDjatYEddY4.cs High entropy of concatenated method names: 'QmGWRmraH3', 'miaWUxh4iv', 'C3TWFqqF6B', 'XhJWcJ20eD', 'OMVWvhusjo', 'J93WaUgD9H', 'U8JWfhWmsn', 'Lj7W9tx4BR', 'FYDWMCn4j0', 'M4yW6RT8fx'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, lE3xLExx4yRHP8Gjl8O.cs High entropy of concatenated method names: 'B2smYDNg1A', 'YtZmz1PNCJ', 'QLrisJeZCw', 'B3Jix5sZZ3', 'Y6nidej2W2', 'w8JiH8UMDi', 'qG6iVgdNyi', 'FHriPXxnp6', 'k0sin8dKcc', 'X3biq9D7tq'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, PYuXog2XHWZlDMdMZy.cs High entropy of concatenated method names: 'G5MQeJ0Ob7', 'PEEQYEUKYb', 'of4lsFanGg', 'dfNlxH9RbC', 'S58QB3w1jB', 'pBuQbywOwv', 'SCUQ43UfhK', 'hK2QI4uOv9', 'WsjQrhOZyT', 'MXaQNmorXB'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, WUyltgI5o6ZgK2WP1H.cs High entropy of concatenated method names: 'bCQk6M31ke', 'vUkkb9G1H3', 'YcfkIvqPJc', 'fi2krwVuEH', 'vjWkUH3Drb', 'sjrkFKIxtJ', 'phFkcwEDEs', 'McdkvnqgW2', 'f08kaBGGF8', 'VCTkf9PuqD'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, MVfNXuELv1PY47s9c1.cs High entropy of concatenated method names: 'xw9qI6KflP', 'jIsqrUgrmu', 'svXqNoGA0m', 'P25qSlo5hZ', 'uBUq7yQ6cQ', 'XHJq20tKwH', 'tPVq0QBg6H', 'Amyqe1e9Sd', 'W6Rqt2gKIm', 'PIvqYVN2vO'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs High entropy of concatenated method names: 'VkAHPjx3Ue', 'Hm9HnOWjZL', 'lHaHqeknC5', 'LfwHXNk6Xx', 'xLoHOQiBDx', 'dU0HjcMSAf', 'tUlHGdbiwT', 'WFgHwJxAn5', 'o6pHZoO5nc', 'xhSHTjpRNG'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, eQFYfaRl2B3Rg6Kqil.cs High entropy of concatenated method names: 'TL6jPs59Fh', 'amajq6huXG', 'wRGjOmWsQt', 'GT5jGZGaro', 'og1jwxHyeV', 'KKOO7tg1Ki', 'VCXO2MjQha', 'uTyO02HDUO', 'EfpOepLVrK', 'YN1OtKGM3I'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, gv9lp2f3vfoYOKUnw4.cs High entropy of concatenated method names: 'QrEGnYHB03', 'd53GXFy96i', 'RhGGjLpxwl', 'MeOjYXfZUO', 'n9GjzU0GoM', 'MsEGsFLXd0', 'chpGxxAOH3', 'mNnGdi1vV4', 'tGSGHMI6n6', 'e77GVFehL1'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, mCEUSLu2HVAxcj9MLj.cs High entropy of concatenated method names: 'V9BXhBIUbd', 'm0xXLtovpu', 'L7SXE9HGrE', 'pKxXujmZ3w', 'ivOXkw2LuK', 'SGUXDk48dn', 'AxuXQROkph', 'dgXXlbM47C', 'YndXWs1H2W', 'r7cXm2p4jT'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, QHRLEaq8QafEmkxm8E.cs High entropy of concatenated method names: 'Dispose', 'oI5xtXY0P4', 'msvdU1CFyp', 'v6DTuKI9CU', 'sfdxYBQ2CG', 'sA1xzyjk4R', 'ProcessDialogKey', 'o2ddslHjFh', 'gDjdxatYEd', 'cY4ddgtch4'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, XfhyyuxdptwT9CrFpp3.cs High entropy of concatenated method names: 'ToString', 'ouPiEGTKM1', 'YyMiuoSdl3', 'LhXi3ewOx4', 'U5ZiR094RB', 'XyCiUZAbhr', 'woSiFn8HcO', 'T5yicwJgU9', 't6sIwkJqc9qMNPagiVR', 'ceatSGJUHyolCxFdX29'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, xJiUvJdSOwk2IKU3P2.cs High entropy of concatenated method names: 'vgv1gxJ9H', 'HpEhKq0ty', 'mQ8LgeCXV', 'aUNKaL315', 'pKXu3LCAT', 'e8a35MEqS', 'npKUlIpgVyyMVT3pwC', 'g5pKgAfoGnJHdW6Rs2', 'UwylkqEPR', 'oR7m3IsnN'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, We5DyIM5S1d3v5tWUG.cs High entropy of concatenated method names: 'J6nGp9gbLZ', 'V64GyJTFie', 'cQDG1chDOy', 'HVRGhMZ1w3', 'pE2GASNeXm', 'JvKGLD55dG', 'xnvGKhN9LX', 'oBcGENVCiZ', 'mmmGudObO5', 'OmCG3BCh4R'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, uwGRIvVnaJ1rs3AesQ.cs High entropy of concatenated method names: 'VpMxGVfNXu', 'Bv1xwPY47s', 'C2HxTVAxcj', 'MMLx8jLVJ8', 'Hy4xkKAPQF', 'YfaxDl2B3R', 'FhagZlCNxMUqcSrPqy', 'qXDoarbT7v1YjOpJNk', 'EjQxx56GKj', 'CyqxHv2bHW'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, y7vHnpXbTQd5M9AyJn.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'giEdtFBhtj', 'Y8rdYvB5gM', 'TTudziAoAL', 'zrhHsAtTML', 'udvHxqkGgx', 'wVHHd5Ub1J', 'PrqHHfoyrK', 'jrqb4m9j6ThpOaxlqDf'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, q7suDPU5dkfR4akZOW.cs High entropy of concatenated method names: 'it6vAMkLtVLUwPuEJF4', 'yALYx7kS22WuwU4UBNF', 'phsjlaJIeI', 'rGejWaKHgS', 't94jmuPEcm', 'VWGMvIkmmp34uBHUGCT', 'XebBfZkG88kn1H1fkDd'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, vtch46YO90XtOrUTp9.cs High entropy of concatenated method names: 'l2qmXtvHfV', 'JxOmOVUmWn', 'UgLmjGJHWY', 'hHpmGf2Dgr', 'PCFmWhVOZO', 'YcImw3KJ11', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, d77XqbcqvedpqQSLRG.cs High entropy of concatenated method names: 'o3CjonacIU', 'EYTjpSflXD', 'HUDj1Q5tg7', 'hVEjh89L7w', 'zWEjL84VmL', 'IstjK62vxE', 'R9njuWXLHW', 'hE2j3iA6rW', 'cGpuhpkdfDXbeohtfBv', 'KiyEqOkDY1S8dEGVp8U'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, i8TCGSzhIFNXFrCaNb.cs High entropy of concatenated method names: 'I3gmLX4Iu7', 'Kx8mEZCHok', 'bHgmuANhHv', 'LMkmRnbXPX', 'QhjmUQdsEc', 'wAJmcOQSPM', 'GlQmvx1yRt', 'WZ5moWX6yG', 'bo4mpJNXWW', 'BjPmyhnvPG'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, BVJ8we3yZQ2puFy4KA.cs High entropy of concatenated method names: 'LR7OAgRJMQ', 'E4uOKsdhwB', 'xMfXF6hhqP', 'bNVXcujqKB', 'y51XvBGgd8', 'rGOXauVi5Y', 'AP9Xf0toTt', 'IUCX9xI4bB', 'MfUXMWPyrA', 'BWZX6R8f2x'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, xi93dHxsxDMH8omRsiw.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'GchmBd2OYj', 'DfFmbFcQCt', 'm0Tm4T8Maa', 'wHomISaRPc', 'zY0mrPLfnI', 'tYomNbXQMg', 'yuKmSfoDfs'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, hCgUrr0eFkI5XY0P4W.cs High entropy of concatenated method names: 'GtfWkICWTb', 'KbaWQsQ1WL', 'bKOWWyIr2V', 'bHqWiuKl20', 'GjQWgQxmVm', 'sgJWoH2lKj', 'Dispose', 'gFBlnoE5lJ', 'lWQlqlc2Ym', 'KZKlXkO7gQ'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, qhJWnR4EwQykKKej0S.cs High entropy of concatenated method names: 'HDDJEG1Qqf', 'dxmJuVbn9l', 'vPkJR0D1vH', 'LN2JUNSBER', 'tdtJcyWOgh', 'TtMJvj6EYF', 'ddMJfHLlx2', 'udWJ9EJniF', 'Q1jJ6YUiyc', 'KvUJBA3Sqk'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, blHjFhtXDjatYEddY4.cs High entropy of concatenated method names: 'QmGWRmraH3', 'miaWUxh4iv', 'C3TWFqqF6B', 'XhJWcJ20eD', 'OMVWvhusjo', 'J93WaUgD9H', 'U8JWfhWmsn', 'Lj7W9tx4BR', 'FYDWMCn4j0', 'M4yW6RT8fx'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, lE3xLExx4yRHP8Gjl8O.cs High entropy of concatenated method names: 'B2smYDNg1A', 'YtZmz1PNCJ', 'QLrisJeZCw', 'B3Jix5sZZ3', 'Y6nidej2W2', 'w8JiH8UMDi', 'qG6iVgdNyi', 'FHriPXxnp6', 'k0sin8dKcc', 'X3biq9D7tq'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, PYuXog2XHWZlDMdMZy.cs High entropy of concatenated method names: 'G5MQeJ0Ob7', 'PEEQYEUKYb', 'of4lsFanGg', 'dfNlxH9RbC', 'S58QB3w1jB', 'pBuQbywOwv', 'SCUQ43UfhK', 'hK2QI4uOv9', 'WsjQrhOZyT', 'MXaQNmorXB'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, WUyltgI5o6ZgK2WP1H.cs High entropy of concatenated method names: 'bCQk6M31ke', 'vUkkb9G1H3', 'YcfkIvqPJc', 'fi2krwVuEH', 'vjWkUH3Drb', 'sjrkFKIxtJ', 'phFkcwEDEs', 'McdkvnqgW2', 'f08kaBGGF8', 'VCTkf9PuqD'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, MVfNXuELv1PY47s9c1.cs High entropy of concatenated method names: 'xw9qI6KflP', 'jIsqrUgrmu', 'svXqNoGA0m', 'P25qSlo5hZ', 'uBUq7yQ6cQ', 'XHJq20tKwH', 'tPVq0QBg6H', 'Amyqe1e9Sd', 'W6Rqt2gKIm', 'PIvqYVN2vO'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs High entropy of concatenated method names: 'VkAHPjx3Ue', 'Hm9HnOWjZL', 'lHaHqeknC5', 'LfwHXNk6Xx', 'xLoHOQiBDx', 'dU0HjcMSAf', 'tUlHGdbiwT', 'WFgHwJxAn5', 'o6pHZoO5nc', 'xhSHTjpRNG'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, eQFYfaRl2B3Rg6Kqil.cs High entropy of concatenated method names: 'TL6jPs59Fh', 'amajq6huXG', 'wRGjOmWsQt', 'GT5jGZGaro', 'og1jwxHyeV', 'KKOO7tg1Ki', 'VCXO2MjQha', 'uTyO02HDUO', 'EfpOepLVrK', 'YN1OtKGM3I'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, gv9lp2f3vfoYOKUnw4.cs High entropy of concatenated method names: 'QrEGnYHB03', 'd53GXFy96i', 'RhGGjLpxwl', 'MeOjYXfZUO', 'n9GjzU0GoM', 'MsEGsFLXd0', 'chpGxxAOH3', 'mNnGdi1vV4', 'tGSGHMI6n6', 'e77GVFehL1'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, mCEUSLu2HVAxcj9MLj.cs High entropy of concatenated method names: 'V9BXhBIUbd', 'm0xXLtovpu', 'L7SXE9HGrE', 'pKxXujmZ3w', 'ivOXkw2LuK', 'SGUXDk48dn', 'AxuXQROkph', 'dgXXlbM47C', 'YndXWs1H2W', 'r7cXm2p4jT'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, QHRLEaq8QafEmkxm8E.cs High entropy of concatenated method names: 'Dispose', 'oI5xtXY0P4', 'msvdU1CFyp', 'v6DTuKI9CU', 'sfdxYBQ2CG', 'sA1xzyjk4R', 'ProcessDialogKey', 'o2ddslHjFh', 'gDjdxatYEd', 'cY4ddgtch4'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, XfhyyuxdptwT9CrFpp3.cs High entropy of concatenated method names: 'ToString', 'ouPiEGTKM1', 'YyMiuoSdl3', 'LhXi3ewOx4', 'U5ZiR094RB', 'XyCiUZAbhr', 'woSiFn8HcO', 'T5yicwJgU9', 't6sIwkJqc9qMNPagiVR', 'ceatSGJUHyolCxFdX29'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, xJiUvJdSOwk2IKU3P2.cs High entropy of concatenated method names: 'vgv1gxJ9H', 'HpEhKq0ty', 'mQ8LgeCXV', 'aUNKaL315', 'pKXu3LCAT', 'e8a35MEqS', 'npKUlIpgVyyMVT3pwC', 'g5pKgAfoGnJHdW6Rs2', 'UwylkqEPR', 'oR7m3IsnN'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, We5DyIM5S1d3v5tWUG.cs High entropy of concatenated method names: 'J6nGp9gbLZ', 'V64GyJTFie', 'cQDG1chDOy', 'HVRGhMZ1w3', 'pE2GASNeXm', 'JvKGLD55dG', 'xnvGKhN9LX', 'oBcGENVCiZ', 'mmmGudObO5', 'OmCG3BCh4R'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, uwGRIvVnaJ1rs3AesQ.cs High entropy of concatenated method names: 'VpMxGVfNXu', 'Bv1xwPY47s', 'C2HxTVAxcj', 'MMLx8jLVJ8', 'Hy4xkKAPQF', 'YfaxDl2B3R', 'FhagZlCNxMUqcSrPqy', 'qXDoarbT7v1YjOpJNk', 'EjQxx56GKj', 'CyqxHv2bHW'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, y7vHnpXbTQd5M9AyJn.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'giEdtFBhtj', 'Y8rdYvB5gM', 'TTudziAoAL', 'zrhHsAtTML', 'udvHxqkGgx', 'wVHHd5Ub1J', 'PrqHHfoyrK', 'jrqb4m9j6ThpOaxlqDf'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, q7suDPU5dkfR4akZOW.cs High entropy of concatenated method names: 'it6vAMkLtVLUwPuEJF4', 'yALYx7kS22WuwU4UBNF', 'phsjlaJIeI', 'rGejWaKHgS', 't94jmuPEcm', 'VWGMvIkmmp34uBHUGCT', 'XebBfZkG88kn1H1fkDd'
Drops PE files
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File created: C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp"

Hooking and other Techniques for Hiding and Protection
barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sample Icon embedded in binary file: icon matches a legit application icon: download (129).png
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 7060, type: MEMORYSTR
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Memory allocated: 18B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Memory allocated: 3270000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Memory allocated: 5270000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Memory allocated: 8120000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Memory allocated: 9120000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Memory allocated: 92D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Memory allocated: A2D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Memory allocated: 1A20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Memory allocated: 33E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Memory allocated: 3320000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5877 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3643 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5431 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4097 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Window / User API: threadDelayed 9776 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 7084 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3972 Thread sleep count: 5877 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3972 Thread sleep count: 3643 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6604 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6588 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 5452 Thread sleep count: 90 > 30 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -99889s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 5452 Thread sleep count: 9776 > 30 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -99777s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -99665s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -99554s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -99442s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -99314s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -99186s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -99076s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -98964s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -98853s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -98741s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -98629s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -98501s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -98373s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -98261s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -98150s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -98039s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -97927s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -97799s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -97671s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -97559s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -97447s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -97335s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -97223s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -97095s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -96967s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -96857s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -96745s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -96633s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -96521s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -96393s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -96265s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -96153s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -96041s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -95929s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -95817s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -95689s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -95561s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -95449s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -95338s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -95226s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -95114s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -94986s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -94858s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -94746s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -94634s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -94522s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -94410s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760 Thread sleep time: -94282s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 99889 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 99777 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 99665 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 99554 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 99442 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 99314 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 99186 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 99076 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 98964 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 98853 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 98741 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 98629 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 98501 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 98373 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 98261 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 98150 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 98039 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 97927 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 97799 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 97671 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 97559 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 97447 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 97335 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 97223 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 97095 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 96967 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 96857 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 96745 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 96633 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 96521 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 96393 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 96265 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 96153 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 96041 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 95929 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 95817 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 95689 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 95561 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 95449 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 95338 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 95226 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 95114 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 94986 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 94858 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 94746 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 94634 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 94522 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 94410 Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Thread delayed: delay time: 94282 Jump to behavior
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000008.00000002.2476600579.0000000001759000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe"
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Memory written: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp" Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Process created: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\userbrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\userbrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\userbrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\userbriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\userFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\userFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\userFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\userST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\userSTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\userSTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\userSTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.3031.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.3031.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2477991883.000000000342E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2477991883.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 7060, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 6524, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File opened: C:\FTP Navigator\Ftplist.txt Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2477991883.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 7060, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 6524, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2477991883.000000000342E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2477991883.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 7060, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 6524, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1559143 Sample: PO] G_24370-24396_SI2_S25_8... Startdate: 20/11/2024 Architecture: WINDOWS Score: 100 36 mail.iaa-airferight.com 2->36 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for dropped file 2->44 46 14 other signatures 2->46 8 PO] G_24370-24396_SI2_S25_8658.exe 6 2->8         started        signatures3 process4 file5 30 C:\Users\user\AppData\...\VxQjXFYhdkY.exe, PE32 8->30 dropped 32 C:\Users\...\VxQjXFYhdkY.exe:Zone.Identifier, ASCII 8->32 dropped 34 C:\Users\user\AppData\Local\...\tmpE291.tmp, XML 8->34 dropped 48 Adds a directory exclusion to Windows Defender 8->48 50 Injects a PE file into a foreign processes 8->50 12 PO] G_24370-24396_SI2_S25_8658.exe 2 8->12         started        16 powershell.exe 22 8->16         started        18 powershell.exe 23 8->18         started        20 schtasks.exe 1 8->20         started        signatures6 process7 dnsIp8 38 mail.iaa-airferight.com 46.175.148.58, 25 ASLAGIDKOM-NETUA Ukraine 12->38 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->52 54 Tries to steal Mail credentials (via file / registry access) 12->54 56 Tries to harvest and steal ftp login credentials 12->56 58 Tries to harvest and steal browser information (history, passwords, etc) 12->58 60 Loading BitLocker PowerShell Module 16->60 22 WmiPrvSE.exe 16->22         started        24 conhost.exe 16->24         started        26 conhost.exe 18->26         started        28 conhost.exe 20->28         started        signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
46.175.148.58
 mail.iaa-airferight.com Ukraine
56394 ASLAGIDKOM-NETUA false

Contacted Domains

Name IP Active
mail.iaa-airferight.com 46.175.148.58 true