Windows Analysis Report
YPzNsfg4nR.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 3.0.24572628.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 3.0.24572628.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000000.2221776118.0000000000342000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2273726750.00000208000A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\ProgramData\coding, type: DROPPED	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: C:\ProgramData\coding, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\Desktop\24572628.exe, type: DROPPED	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\Desktop\24572628.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\24572628.exe	Code function: 3_2_00007FF848A41290	3_2_00007FF848A41290
Source: C:\Users\user\Desktop\24572628.exe	Code function: 3_2_00007FF848A46E72	3_2_00007FF848A46E72
Source: C:\Users\user\Desktop\24572628.exe	Code function: 3_2_00007FF848A41719	3_2_00007FF848A41719
Source: C:\Users\user\Desktop\24572628.exe	Code function: 3_2_00007FF848A460C6	3_2_00007FF848A460C6
Source: C:\Users\user\Desktop\24572628.exe	Code function: 3_2_00007FF848A4108D	3_2_00007FF848A4108D
Source: C:\Users\user\Desktop\24572628.exe	Code function: 3_2_00007FF848A420F1	3_2_00007FF848A420F1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848B130E7	4_2_00007FF848B130E7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848B330E9	8_2_00007FF848B330E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF848B42E11	13_2_00007FF848B42E11
Source: C:\ProgramData\coding	Code function: 17_2_00007FF848A71719	17_2_00007FF848A71719
Source: C:\ProgramData\coding	Code function: 17_2_00007FF848A720F1	17_2_00007FF848A720F1
Source: C:\ProgramData\coding	Code function: 17_2_00007FF848A71038	17_2_00007FF848A71038
Source: C:\ProgramData\coding	Code function: 21_2_00007FF848A31719	21_2_00007FF848A31719
Source: C:\ProgramData\coding	Code function: 21_2_00007FF848A320F1	21_2_00007FF848A320F1
Source: C:\ProgramData\coding	Code function: 21_2_00007FF848A31038	21_2_00007FF848A31038

Source: YPzNsfg4nR.exe

Static PE information: No import functions for PE file found

Source: YPzNsfg4nR.exe, 00000000.00000000.2176160386.0000020868AC6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename1fht7W0d34QhN.exe< vs YPzNsfg4nR.exe
Source: YPzNsfg4nR.exe, 00000000.00000002.2273726750.00000208000A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamexingping.exe4 vs YPzNsfg4nR.exe
Source: YPzNsfg4nR.exe, 00000000.00000002.2274202770.0000020868C65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamexiW vs YPzNsfg4nR.exe
Source: YPzNsfg4nR.exe	Binary or memory string: OriginalFilename1fht7W0d34QhN.exe< vs YPzNsfg4nR.exe

Source: 3.0.24572628.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 3.0.24572628.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000000.2221776118.0000000000342000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2273726750.00000208000A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\ProgramData\coding, type: DROPPED	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: C:\ProgramData\coding, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\Desktop\24572628.exe, type: DROPPED	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: C:\Users\user\Desktop\24572628.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: YPzNsfg4nR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: YPzNsfg4nR.exe, Loader.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24572628.exe.0.dr, OszBM2fJqaqDqfTYb3i92yMDtuZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 24572628.exe.0.dr, OszBM2fJqaqDqfTYb3i92yMDtuZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 24572628.exe.0.dr, SIIG8lqorRBYoF5JEoCZBv9CuNq.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, OszBM2fJqaqDqfTYb3i92yMDtuZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, OszBM2fJqaqDqfTYb3i92yMDtuZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, SIIG8lqorRBYoF5JEoCZBv9CuNq.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: coding.3.dr, OszBM2fJqaqDqfTYb3i92yMDtuZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: coding.3.dr, OszBM2fJqaqDqfTYb3i92yMDtuZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: coding.3.dr, SIIG8lqorRBYoF5JEoCZBv9CuNq.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, IO1UOhIFtJUrq7FFz6TE95gcPv3vcEtJ2sUCsLDnYmwnk7Bi3nQvt8hBnnHX1W7MSOynjPXn52SG8fIjMKC9I.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, IO1UOhIFtJUrq7FFz6TE95gcPv3vcEtJ2sUCsLDnYmwnk7Bi3nQvt8hBnnHX1W7MSOynjPXn52SG8fIjMKC9I.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 24572628.exe.0.dr, IO1UOhIFtJUrq7FFz6TE95gcPv3vcEtJ2sUCsLDnYmwnk7Bi3nQvt8hBnnHX1W7MSOynjPXn52SG8fIjMKC9I.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 24572628.exe.0.dr, IO1UOhIFtJUrq7FFz6TE95gcPv3vcEtJ2sUCsLDnYmwnk7Bi3nQvt8hBnnHX1W7MSOynjPXn52SG8fIjMKC9I.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: coding.3.dr, IO1UOhIFtJUrq7FFz6TE95gcPv3vcEtJ2sUCsLDnYmwnk7Bi3nQvt8hBnnHX1W7MSOynjPXn52SG8fIjMKC9I.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: coding.3.dr, IO1UOhIFtJUrq7FFz6TE95gcPv3vcEtJ2sUCsLDnYmwnk7Bi3nQvt8hBnnHX1W7MSOynjPXn52SG8fIjMKC9I.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@24/28@2/3

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe

File created: C:\Users\user\Desktop\xxx.log

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7336:120:WilError_03
Source: C:\ProgramData\coding	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3628:120:WilError_03
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7752:120:WilError_03
Source: C:\Users\user\Desktop\24572628.exe	Mutant created: \Sessions\1\BaseNamedObjects\HAzSfCvWFIXriVXa
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3536:120:WilError_03

Source: C:\Users\user\Desktop\24572628.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Source: YPzNsfg4nR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: YPzNsfg4nR.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: YPzNsfg4nR.exe

Virustotal: Detection: 16%

Source: unknown	Process created: C:\Users\user\Desktop\YPzNsfg4nR.exe "C:\Users\user\Desktop\YPzNsfg4nR.exe"
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process created: C:\Users\user\Desktop\24572628.exe "C:\Users\user\Desktop\24572628.exe"
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\24572628.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '24572628.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\coding'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'coding'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "coding" /tr "C:\ProgramData\coding"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\coding C:\ProgramData\coding
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\ProgramData\coding C:\ProgramData\coding
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process created: C:\Users\user\Desktop\24572628.exe "C:\Users\user\Desktop\24572628.exe"	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\24572628.exe'	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '24572628.exe'	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\coding'	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'coding'	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "coding" /tr "C:\ProgramData\coding"	Jump to behavior

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\ProgramData\coding	Section loaded: mscoree.dll
Source: C:\ProgramData\coding	Section loaded: apphelp.dll
Source: C:\ProgramData\coding	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\coding	Section loaded: version.dll
Source: C:\ProgramData\coding	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\coding	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\coding	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\coding	Section loaded: uxtheme.dll
Source: C:\ProgramData\coding	Section loaded: sspicli.dll
Source: C:\ProgramData\coding	Section loaded: cryptsp.dll
Source: C:\ProgramData\coding	Section loaded: rsaenh.dll
Source: C:\ProgramData\coding	Section loaded: cryptbase.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\ProgramData\coding	Section loaded: mscoree.dll
Source: C:\ProgramData\coding	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\coding	Section loaded: version.dll
Source: C:\ProgramData\coding	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\coding	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\coding	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\coding	Section loaded: uxtheme.dll
Source: C:\ProgramData\coding	Section loaded: sspicli.dll
Source: C:\ProgramData\coding	Section loaded: cryptsp.dll
Source: C:\ProgramData\coding	Section loaded: rsaenh.dll
Source: C:\ProgramData\coding	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Source: coding.lnk.3.dr

LNK file: ..\..\..\..\..\..\..\..\..\ProgramData\coding

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: YPzNsfg4nR.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: YPzNsfg4nR.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: YPzNsfg4nR.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: YPzNsfg4nR.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \ConsoleApp4\obj\Release\net4.8\win-x64\1fht7W0d34QhN.pdbSHA256J source: YPzNsfg4nR.exe
Source:	Binary string: \ConsoleApp4\obj\Release\net4.8\win-x64\1fht7W0d34QhN.pdb source: YPzNsfg4nR.exe

Data Obfuscation

Source: 24572628.exe.0.dr, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z._5i4SAQhuc91ROiWCzo5Pf6RTeAh2vkXbKPbnZgcGS7EJ9WTQi380QHhzZ2TCuSLF2x7JzKBW5haPN8JirQ7i4,RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z.WjOzvpLnp5VNZhNSe5arbH2DAbJgI32DSSRm8Ajkw0IPeUKxyIDS5YRZb7fT65eOdWNH4f5s5uEdYie3mF0Ws,RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z._9eZ2cQYC4RGIU6SXHbNeKcevZLSx2jq4rUQDsoavnesEBTtfmmMid9ubLQZbrYsCPFAobvqaMOJDzFmmmVnSz,RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z.wKABsnxs3jsj5dVuYrHC1DirE4MCFqTaC0iWPKFElnZhjbTVZ8bepZ817q0USmjPsMJVwHQOLR5QFZenR6B4E,OszBM2fJqaqDqfTYb3i92yMDtuZ.qkD9uNU4VX0eyH13IN643S6BNs7()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 24572628.exe.0.dr, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{uq8xTlDRinxDVb8hTq0qDdZr8bs[2],OszBM2fJqaqDqfTYb3i92yMDtuZ.nunvLMQGPjDFLCBkvQa4RNkS6pM(Convert.FromBase64String(uq8xTlDRinxDVb8hTq0qDdZr8bs[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z._5i4SAQhuc91ROiWCzo5Pf6RTeAh2vkXbKPbnZgcGS7EJ9WTQi380QHhzZ2TCuSLF2x7JzKBW5haPN8JirQ7i4,RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z.WjOzvpLnp5VNZhNSe5arbH2DAbJgI32DSSRm8Ajkw0IPeUKxyIDS5YRZb7fT65eOdWNH4f5s5uEdYie3mF0Ws,RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z._9eZ2cQYC4RGIU6SXHbNeKcevZLSx2jq4rUQDsoavnesEBTtfmmMid9ubLQZbrYsCPFAobvqaMOJDzFmmmVnSz,RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z.wKABsnxs3jsj5dVuYrHC1DirE4MCFqTaC0iWPKFElnZhjbTVZ8bepZ817q0USmjPsMJVwHQOLR5QFZenR6B4E,OszBM2fJqaqDqfTYb3i92yMDtuZ.qkD9uNU4VX0eyH13IN643S6BNs7()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{uq8xTlDRinxDVb8hTq0qDdZr8bs[2],OszBM2fJqaqDqfTYb3i92yMDtuZ.nunvLMQGPjDFLCBkvQa4RNkS6pM(Convert.FromBase64String(uq8xTlDRinxDVb8hTq0qDdZr8bs[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: coding.3.dr, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z._5i4SAQhuc91ROiWCzo5Pf6RTeAh2vkXbKPbnZgcGS7EJ9WTQi380QHhzZ2TCuSLF2x7JzKBW5haPN8JirQ7i4,RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z.WjOzvpLnp5VNZhNSe5arbH2DAbJgI32DSSRm8Ajkw0IPeUKxyIDS5YRZb7fT65eOdWNH4f5s5uEdYie3mF0Ws,RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z._9eZ2cQYC4RGIU6SXHbNeKcevZLSx2jq4rUQDsoavnesEBTtfmmMid9ubLQZbrYsCPFAobvqaMOJDzFmmmVnSz,RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z.wKABsnxs3jsj5dVuYrHC1DirE4MCFqTaC0iWPKFElnZhjbTVZ8bepZ817q0USmjPsMJVwHQOLR5QFZenR6B4E,OszBM2fJqaqDqfTYb3i92yMDtuZ.qkD9uNU4VX0eyH13IN643S6BNs7()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: coding.3.dr, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{uq8xTlDRinxDVb8hTq0qDdZr8bs[2],OszBM2fJqaqDqfTYb3i92yMDtuZ.nunvLMQGPjDFLCBkvQa4RNkS6pM(Convert.FromBase64String(uq8xTlDRinxDVb8hTq0qDdZr8bs[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 24572628.exe.0.dr, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: A489ErlwV9A4dCeG59RzSh9kbzW System.AppDomain.Load(byte[])
Source: 24572628.exe.0.dr, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: _1YkqxFS5uSQpaKbGKVjN0u3j8hQ System.AppDomain.Load(byte[])
Source: 24572628.exe.0.dr, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: _1YkqxFS5uSQpaKbGKVjN0u3j8hQ
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: A489ErlwV9A4dCeG59RzSh9kbzW System.AppDomain.Load(byte[])
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: _1YkqxFS5uSQpaKbGKVjN0u3j8hQ System.AppDomain.Load(byte[])
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: _1YkqxFS5uSQpaKbGKVjN0u3j8hQ
Source: coding.3.dr, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: A489ErlwV9A4dCeG59RzSh9kbzW System.AppDomain.Load(byte[])
Source: coding.3.dr, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: _1YkqxFS5uSQpaKbGKVjN0u3j8hQ System.AppDomain.Load(byte[])
Source: coding.3.dr, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	.Net Code: _1YkqxFS5uSQpaKbGKVjN0u3j8hQ

Source: YPzNsfg4nR.exe

Static PE information: 0xA7BF61F9 [Sat Mar 8 08:25:29 2059 UTC]

Source: C:\Users\user\Desktop\24572628.exe	Code function: 3_2_00007FF848A400BD pushad ; iretd	3_2_00007FF848A400C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF84892D2A5 pushad ; iretd	4_2_00007FF84892D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848A4B98C push ecx; retf	4_2_00007FF848A4B9F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848A4351D pushfd ; ret	4_2_00007FF848A43552
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848A4B9FA push edx; retf	4_2_00007FF848A4BA02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848A4BA03 push ecx; retf	4_2_00007FF848A4B9F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848A42648 push cs; ret	4_2_00007FF848A42692
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848A428B5 pushad ; ret	4_2_00007FF848A428BA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848A428E3 pushad ; ret	4_2_00007FF848A42901
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848A428BB pushad ; ret	4_2_00007FF848A42901
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848A4280B push edx; ret	4_2_00007FF848A42862
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF848B12316 push 8B485F94h; iretd	4_2_00007FF848B1231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF84894D2A5 pushad ; iretd	8_2_00007FF84894D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848A6A5F5 push edx; retf	8_2_00007FF848A6A64A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848A6A63C push edx; retf	8_2_00007FF848A6A64A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848A6A70C push esi; retf	8_2_00007FF848A6A74A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848B32316 push 8B485F92h; iretd	8_2_00007FF848B3231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF84894D2A5 pushad ; iretd	11_2_00007FF84894D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A6A99C push esi; retf	11_2_00007FF848A6A9AA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A6A785 push edx; retf	11_2_00007FF848A6A7DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A6A7CC push edx; retf	11_2_00007FF848A6A7DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A6A90C push esi; retf	11_2_00007FF848A6A90D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A6A976 push esi; retf	11_2_00007FF848A6A98A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A6A945 push esi; retf	11_2_00007FF848A6A946
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A6A8AB push esi; retf	11_2_00007FF848A6A8DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A6A89C push edx; retf	11_2_00007FF848A6A8AA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A6A876 push edx; retf	11_2_00007FF848A6A88A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848A619DA pushad ; ret	11_2_00007FF848A619E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF848B32316 push 8B485F92h; iretd	11_2_00007FF848B3231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF84895D2A5 pushad ; iretd	13_2_00007FF84895D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF848B42316 push 8B485F91h; iretd	13_2_00007FF848B4231B

Source: YPzNsfg4nR.exe

Static PE information: section name: .text entropy: 7.988299230220677

Source: 24572628.exe.0.dr, RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z.cs	High entropy of concatenated method names: 'eWay4ijsjdJkk17wWU7GeteegCJUQiFH46b75RkmCBZp', 'wEXysZZltYsjYTNSi1e0mzHb63Z1TeRJvHnO7WwBdWyH', 'Coc7cRW2Xg6GyVWvawFJXpJSPw2V91gtbrIr3yXyapSB', 'Sg0jsaILtyJNL6YmlWWv0pqdLjui8TT5f7uWOEbtf6kU'
Source: 24572628.exe.0.dr, 51TA3tWw5IuwaflNu15g6hOVOGMSECCRacSwhTwnJLqYyKkuCZ4GVRujK5B.cs	High entropy of concatenated method names: 'gPg8aH1NlxgXZrUR82TrxnwVLduRbHt2dVldLJuGgFs994sKFtyu8nFxnkX', 'N1OEkRyv1WdRTBlNrukmfNHi3ERZ3eO4WmeQxKPsPO26XP3MBQonn2DCNR4', 'VdGKaqwiCkP0Tks33qXRo7nuwxVSUUf9tiBA6K1JOoQbrwzarSIj2GcIaiW', 'yzTdo5JAiTcUNM4Aax0', '_3JRdxbCXECrBO8cWp5U', 'dKQvkQEsn93bzoDpCKF', 'WDnqeUqzNRllozcHXJE', 'fHaF7qEZzWBcqfNqS7e', 'RkoyrXFtso75SWs1IHl', '_929CGkP8u8LURpOeE4m'
Source: 24572628.exe.0.dr, Yu8PsOvdqdBbsmzeNGpgYeaKbq1IkYDLsIBLuKmhZZtjtnxFFYKYRxD6IQ7uNip706VKKdVvdgCs6awfVWcW8UNjklxvuEsRjSO.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_2Jt8Ph2JvZovaSM7QmYCVdSg7ZyuQ2FkFy963KddiN3X9L8A7JnSNaAxuY4', 'bDJQlhxE9uVGMuof3JgGqmKhGxfrfyKBb1v57g7bx6d1xRHYvebFgZIOnIF', 'im1C1FexW7Bd7L2OQkItHQHizq52HsiDPAC6mnymzNDW5miKmlsDS63MOTq', '_3Vqn5nXmRx96TYTukVrLEPtqRCRTSP6dTSnfoo6nTIwHRQnfDPm8aQexlNp'
Source: 24572628.exe.0.dr, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	High entropy of concatenated method names: 'XRN4Y7KffVBYkqV1gFrkgXj3eyq', 'A489ErlwV9A4dCeG59RzSh9kbzW', 'YOW35931rXD0jFxvxfOXF9qp3e8', 'mdVSAGCsiFQT6SL3QinghcxhUwN', 'VGJj30Tw3qEGKsEE3h70GSWbrnm', 't5UiWvmeSVasrauRTqaeUUbpY6u', 'QqCwprBCyaaw5FD9E6QovodNNCn', 't3bNN1mJNFrbRl2QexvkgxGdlZA', 'Uchszl676AMBmtntJysiVwRXKMQ', 'WIWKuGr40nxtaEQowgzmXtEt7sw'
Source: 24572628.exe.0.dr, IO1UOhIFtJUrq7FFz6TE95gcPv3vcEtJ2sUCsLDnYmwnk7Bi3nQvt8hBnnHX1W7MSOynjPXn52SG8fIjMKC9I.cs	High entropy of concatenated method names: '_7a2RgqA4h9MnAhXwwZRFGCTuKaTbSVvm9Sjn3T9Kw8GalL3bRS7w0LkS2zBOikSk8qpod4BfFp2Aq8ykDxe1H', 'TOBkc6FXFu1mw67EbEmLtZT3bCL1ttQJM8I21kaWj3oDXdQQogEP4E4cf1RQqj9vhIMSr3O8IFPUp4yAWp61U', 'U6VuRIYy46vANFFrFNriRe1vuRMNXp4yfMyK5J11ANoNJY5sBBLnXwQvJ1wvBijG2KRNdADDQ4kDcUbwRRC7i', 'mxRTunPLpaCXGaI6NbC3YPGzqeOA40Do4oFrQj9BchoL8FLAy7aPgK5BKu2dDDUrfR7v8DKCWIikofzcOBI6V', 'v7Y7CLj49Hc0KO0TtSvRtwAOjW2iqinnZwJqjlLhoNHQ8aqSODp16t4qdZTMx7q98GETk18n9HrW7SFsIv0LG', 'T0AeetyOPv4yuEworKv76m0DPX7', 'sqHAqdfVLYznRohHd8e6WTbSIui', 'hsVw0xNOYXaqPvUPQAMNUmELmvE', '_0ymHvWrEkrMuSepPI04uwSas8l1', '_3MGGB8dCJwZrZRxGWLv3DqINsLE'
Source: 24572628.exe.0.dr, OszBM2fJqaqDqfTYb3i92yMDtuZ.cs	High entropy of concatenated method names: 'xidvVpyftr0TARr6SyFK120zke5', 'cazNyFjELr2aaOSrDPPwhvLPef0', 'IV7f8BjbMecOHjAFrQqr92Y8mOZ', 'Ut2E7ioakBwDCnVjl3NrOYK0jlF', 'ap82692bj9sL1IPmzthM4moxbeR', 'EXzqiOLGWwfCjJyCkuly48LErA7', 'rTZBWRw4hmwFzvsBKeTxbJsXcQt', 'OAl0dJLveQummh269wwNXBLNdYG', 'b2JxfhLhtRcQxHcPpDM2IvQTp23', '_0CD003T1QUgHbzgeEcc4mzwtJh9'
Source: 24572628.exe.0.dr, 6Dhi8Wb4ZsGZiWpniMf0gM4H4sj.cs	High entropy of concatenated method names: 'e97UE8lAKCPtzzsqopGwpI0JZKD', 'C1Mh5FfC46zqSPZLrEHcvHzSszw5cH6CiDvtUGKIDpUhpURHuKGKiKF8OzAdLblC6f5Lv8jYHOhS7', '_6oCtn4yPIrxkQJxr3QxIfOJ7kMolPcw7nrzUKsrQd97b9ujHM8F9Kmdag301HFb9OHeu8oqwPiH3y', 'uMAoFuu71wW7SoYmIBSR9xa7qqFuk08XYBlq7x8S8waGDa5itFDcAy2TYwN2QGpPUM4W2Uig8ViKP', 'EZJgNSBfT283ehB6J38sl27uAj0OHSofO6kngsQGCtS276vFQvCDORrFIe1zFxbAaULmSJTJ5HE3X'
Source: 24572628.exe.0.dr, Q6RXh22YWFNEsWThUdGyFlXlpv73imik40KVOsv5cQHzChzaLrhtXsFvgTML0HwxoG7yOuzlGFnPqkfILokIJ.cs	High entropy of concatenated method names: 'dWIr7OLiEnuOfkKwsuFLdMQmoC87zAuDww9ykJKUdGKAlD0R29ScllCHtM7GatcTJKDqrhdgfo9nKpeFCAqH4', 'UsPA0yyKrFDT4YMs1WmBxMp71pytyVMBywo9EIlSvZpfXnaT8DAk51OLVk2vY5p8bz3vbLSj6XN1d7DvmCD8C', 'fDHZaLZ51olnlvgTUoW5ZZ1l3jnUgEAyKh981AyB9ob2dFvnoSyXaFhZ2pq6C6IlSXkuVyKl94fSG6kSrWPWQ', 'RPTdjkVwktugaPmgLcahJrBYyUHr6Jhy1QU6dcB17rPoshCrHgoOoaKNoBd0tZ4FyjKI1XTAKib13T9ZVIuts', 'MyivBc7NppTrkV9ty2QHprAhfg8m2I527EC6KeKTYaWCWRRTyIbhCCIU0USUvJhxoustt81iXZUCbSCZIER40', 'bakjUV2m6vbJ6toUEYH1cAAIHcGysvBzRxDl9YPFcYtbevevL5R9r6JoiWhD2bWV9KOyZpbSdFfP1uBRU7awH', '_6BeUae8tSbCFeb4NGv5b9ih1XspUQpbSF0BBVp6VOkWRlYcP6h2pyQWr35NXAbIqJPMDCkQvlXCZXY6DB0tjQ', 'tE0AsQgAwdQqiO8BDrQr5ZcYkg9tfb3e0TR6YLjCXb5SiDthmhMzthas1DmOrEt2OYSMOZG9G4TzoAecECpP1', 'DPnUj4NQ5rq9dCZUOuoLGpKPuHkgCiI4kuqac2Ggd9ndTKmHSh2tznYgXYojkYyMjAmxwhoI7QSP3wNZRhVF0', 'p1XOSKQyP9RuZBRNZM1c800jcqppbOVM6Nxs4qMznZvowsLtVFFc8alOkYs1eVy4b7LBprYn6lIb8THZR4BGd'
Source: 24572628.exe.0.dr, XRg5CXzghacu61mWJVTLzsueymr.cs	High entropy of concatenated method names: 'w1qPaUREO7T8hRMQz9GQxE25SXN', '_2iHgS5h0BqQUHK7TeTnxAOhnVgM', 'nfd6r5aBUpsy7CE8rO9VJhSYMre', 'OeZXC5mjse5URVGoXdFBLFGQ9fy', 'qVPyN3zZ2Fopgul5Iqx', 'PGah0mI29WHAiwuyJSF', 'jMaMzC3giKZVOXKQcg2', 'SX20c3RWuqbp5JbFd3i', 'yKOiYDyRU4P1NXn4R1H', 'Q6O7Um3JjDhLJWjFZkf'
Source: 24572628.exe.0.dr, R2IfcvgzWekfqbuZeqPv4fujzXh.cs	High entropy of concatenated method names: 'GBUvwHj9hGdSdzf7eHgmiogVZiC', '_6lCL66hhXp3WGaGlAph3qC3UjvD', 'JmPzGWLVMSN6gbqZm5YCWCyMK2U', 'iEGrLLZwRN1c2ldpS01IjrAzd03', 'x0SK5wTlyL2wUlhFiIW7UcxXFpg', 'qRJdGH6fomWzdv4Z32TxPZYLul0', 'wkXGOCFqfXqw5npMP1P60RX0YT1', 'Lqg8Y6rFujCVFRB2iBAczp8YHpp', 'dNT12v4ke3EiYiRWnUDJrH1PALh', 'N03dsuRLQq27QaHq5wD1VjQZpyd'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z.cs	High entropy of concatenated method names: 'eWay4ijsjdJkk17wWU7GeteegCJUQiFH46b75RkmCBZp', 'wEXysZZltYsjYTNSi1e0mzHb63Z1TeRJvHnO7WwBdWyH', 'Coc7cRW2Xg6GyVWvawFJXpJSPw2V91gtbrIr3yXyapSB', 'Sg0jsaILtyJNL6YmlWWv0pqdLjui8TT5f7uWOEbtf6kU'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, 51TA3tWw5IuwaflNu15g6hOVOGMSECCRacSwhTwnJLqYyKkuCZ4GVRujK5B.cs	High entropy of concatenated method names: 'gPg8aH1NlxgXZrUR82TrxnwVLduRbHt2dVldLJuGgFs994sKFtyu8nFxnkX', 'N1OEkRyv1WdRTBlNrukmfNHi3ERZ3eO4WmeQxKPsPO26XP3MBQonn2DCNR4', 'VdGKaqwiCkP0Tks33qXRo7nuwxVSUUf9tiBA6K1JOoQbrwzarSIj2GcIaiW', 'yzTdo5JAiTcUNM4Aax0', '_3JRdxbCXECrBO8cWp5U', 'dKQvkQEsn93bzoDpCKF', 'WDnqeUqzNRllozcHXJE', 'fHaF7qEZzWBcqfNqS7e', 'RkoyrXFtso75SWs1IHl', '_929CGkP8u8LURpOeE4m'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, Yu8PsOvdqdBbsmzeNGpgYeaKbq1IkYDLsIBLuKmhZZtjtnxFFYKYRxD6IQ7uNip706VKKdVvdgCs6awfVWcW8UNjklxvuEsRjSO.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_2Jt8Ph2JvZovaSM7QmYCVdSg7ZyuQ2FkFy963KddiN3X9L8A7JnSNaAxuY4', 'bDJQlhxE9uVGMuof3JgGqmKhGxfrfyKBb1v57g7bx6d1xRHYvebFgZIOnIF', 'im1C1FexW7Bd7L2OQkItHQHizq52HsiDPAC6mnymzNDW5miKmlsDS63MOTq', '_3Vqn5nXmRx96TYTukVrLEPtqRCRTSP6dTSnfoo6nTIwHRQnfDPm8aQexlNp'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	High entropy of concatenated method names: 'XRN4Y7KffVBYkqV1gFrkgXj3eyq', 'A489ErlwV9A4dCeG59RzSh9kbzW', 'YOW35931rXD0jFxvxfOXF9qp3e8', 'mdVSAGCsiFQT6SL3QinghcxhUwN', 'VGJj30Tw3qEGKsEE3h70GSWbrnm', 't5UiWvmeSVasrauRTqaeUUbpY6u', 'QqCwprBCyaaw5FD9E6QovodNNCn', 't3bNN1mJNFrbRl2QexvkgxGdlZA', 'Uchszl676AMBmtntJysiVwRXKMQ', 'WIWKuGr40nxtaEQowgzmXtEt7sw'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, IO1UOhIFtJUrq7FFz6TE95gcPv3vcEtJ2sUCsLDnYmwnk7Bi3nQvt8hBnnHX1W7MSOynjPXn52SG8fIjMKC9I.cs	High entropy of concatenated method names: '_7a2RgqA4h9MnAhXwwZRFGCTuKaTbSVvm9Sjn3T9Kw8GalL3bRS7w0LkS2zBOikSk8qpod4BfFp2Aq8ykDxe1H', 'TOBkc6FXFu1mw67EbEmLtZT3bCL1ttQJM8I21kaWj3oDXdQQogEP4E4cf1RQqj9vhIMSr3O8IFPUp4yAWp61U', 'U6VuRIYy46vANFFrFNriRe1vuRMNXp4yfMyK5J11ANoNJY5sBBLnXwQvJ1wvBijG2KRNdADDQ4kDcUbwRRC7i', 'mxRTunPLpaCXGaI6NbC3YPGzqeOA40Do4oFrQj9BchoL8FLAy7aPgK5BKu2dDDUrfR7v8DKCWIikofzcOBI6V', 'v7Y7CLj49Hc0KO0TtSvRtwAOjW2iqinnZwJqjlLhoNHQ8aqSODp16t4qdZTMx7q98GETk18n9HrW7SFsIv0LG', 'T0AeetyOPv4yuEworKv76m0DPX7', 'sqHAqdfVLYznRohHd8e6WTbSIui', 'hsVw0xNOYXaqPvUPQAMNUmELmvE', '_0ymHvWrEkrMuSepPI04uwSas8l1', '_3MGGB8dCJwZrZRxGWLv3DqINsLE'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, OszBM2fJqaqDqfTYb3i92yMDtuZ.cs	High entropy of concatenated method names: 'xidvVpyftr0TARr6SyFK120zke5', 'cazNyFjELr2aaOSrDPPwhvLPef0', 'IV7f8BjbMecOHjAFrQqr92Y8mOZ', 'Ut2E7ioakBwDCnVjl3NrOYK0jlF', 'ap82692bj9sL1IPmzthM4moxbeR', 'EXzqiOLGWwfCjJyCkuly48LErA7', 'rTZBWRw4hmwFzvsBKeTxbJsXcQt', 'OAl0dJLveQummh269wwNXBLNdYG', 'b2JxfhLhtRcQxHcPpDM2IvQTp23', '_0CD003T1QUgHbzgeEcc4mzwtJh9'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, 6Dhi8Wb4ZsGZiWpniMf0gM4H4sj.cs	High entropy of concatenated method names: 'e97UE8lAKCPtzzsqopGwpI0JZKD', 'C1Mh5FfC46zqSPZLrEHcvHzSszw5cH6CiDvtUGKIDpUhpURHuKGKiKF8OzAdLblC6f5Lv8jYHOhS7', '_6oCtn4yPIrxkQJxr3QxIfOJ7kMolPcw7nrzUKsrQd97b9ujHM8F9Kmdag301HFb9OHeu8oqwPiH3y', 'uMAoFuu71wW7SoYmIBSR9xa7qqFuk08XYBlq7x8S8waGDa5itFDcAy2TYwN2QGpPUM4W2Uig8ViKP', 'EZJgNSBfT283ehB6J38sl27uAj0OHSofO6kngsQGCtS276vFQvCDORrFIe1zFxbAaULmSJTJ5HE3X'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, Q6RXh22YWFNEsWThUdGyFlXlpv73imik40KVOsv5cQHzChzaLrhtXsFvgTML0HwxoG7yOuzlGFnPqkfILokIJ.cs	High entropy of concatenated method names: 'dWIr7OLiEnuOfkKwsuFLdMQmoC87zAuDww9ykJKUdGKAlD0R29ScllCHtM7GatcTJKDqrhdgfo9nKpeFCAqH4', 'UsPA0yyKrFDT4YMs1WmBxMp71pytyVMBywo9EIlSvZpfXnaT8DAk51OLVk2vY5p8bz3vbLSj6XN1d7DvmCD8C', 'fDHZaLZ51olnlvgTUoW5ZZ1l3jnUgEAyKh981AyB9ob2dFvnoSyXaFhZ2pq6C6IlSXkuVyKl94fSG6kSrWPWQ', 'RPTdjkVwktugaPmgLcahJrBYyUHr6Jhy1QU6dcB17rPoshCrHgoOoaKNoBd0tZ4FyjKI1XTAKib13T9ZVIuts', 'MyivBc7NppTrkV9ty2QHprAhfg8m2I527EC6KeKTYaWCWRRTyIbhCCIU0USUvJhxoustt81iXZUCbSCZIER40', 'bakjUV2m6vbJ6toUEYH1cAAIHcGysvBzRxDl9YPFcYtbevevL5R9r6JoiWhD2bWV9KOyZpbSdFfP1uBRU7awH', '_6BeUae8tSbCFeb4NGv5b9ih1XspUQpbSF0BBVp6VOkWRlYcP6h2pyQWr35NXAbIqJPMDCkQvlXCZXY6DB0tjQ', 'tE0AsQgAwdQqiO8BDrQr5ZcYkg9tfb3e0TR6YLjCXb5SiDthmhMzthas1DmOrEt2OYSMOZG9G4TzoAecECpP1', 'DPnUj4NQ5rq9dCZUOuoLGpKPuHkgCiI4kuqac2Ggd9ndTKmHSh2tznYgXYojkYyMjAmxwhoI7QSP3wNZRhVF0', 'p1XOSKQyP9RuZBRNZM1c800jcqppbOVM6Nxs4qMznZvowsLtVFFc8alOkYs1eVy4b7LBprYn6lIb8THZR4BGd'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, XRg5CXzghacu61mWJVTLzsueymr.cs	High entropy of concatenated method names: 'w1qPaUREO7T8hRMQz9GQxE25SXN', '_2iHgS5h0BqQUHK7TeTnxAOhnVgM', 'nfd6r5aBUpsy7CE8rO9VJhSYMre', 'OeZXC5mjse5URVGoXdFBLFGQ9fy', 'qVPyN3zZ2Fopgul5Iqx', 'PGah0mI29WHAiwuyJSF', 'jMaMzC3giKZVOXKQcg2', 'SX20c3RWuqbp5JbFd3i', 'yKOiYDyRU4P1NXn4R1H', 'Q6O7Um3JjDhLJWjFZkf'
Source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, R2IfcvgzWekfqbuZeqPv4fujzXh.cs	High entropy of concatenated method names: 'GBUvwHj9hGdSdzf7eHgmiogVZiC', '_6lCL66hhXp3WGaGlAph3qC3UjvD', 'JmPzGWLVMSN6gbqZm5YCWCyMK2U', 'iEGrLLZwRN1c2ldpS01IjrAzd03', 'x0SK5wTlyL2wUlhFiIW7UcxXFpg', 'qRJdGH6fomWzdv4Z32TxPZYLul0', 'wkXGOCFqfXqw5npMP1P60RX0YT1', 'Lqg8Y6rFujCVFRB2iBAczp8YHpp', 'dNT12v4ke3EiYiRWnUDJrH1PALh', 'N03dsuRLQq27QaHq5wD1VjQZpyd'
Source: coding.3.dr, RWYlUp8SC4AqlyeOaRAKtexLHzJLkDNHPRoqbwLt7tyIWcVkPDeBP0TESEdQlABBp6uS3UFLvWhYnwTTrXH2z.cs	High entropy of concatenated method names: 'eWay4ijsjdJkk17wWU7GeteegCJUQiFH46b75RkmCBZp', 'wEXysZZltYsjYTNSi1e0mzHb63Z1TeRJvHnO7WwBdWyH', 'Coc7cRW2Xg6GyVWvawFJXpJSPw2V91gtbrIr3yXyapSB', 'Sg0jsaILtyJNL6YmlWWv0pqdLjui8TT5f7uWOEbtf6kU'
Source: coding.3.dr, 51TA3tWw5IuwaflNu15g6hOVOGMSECCRacSwhTwnJLqYyKkuCZ4GVRujK5B.cs	High entropy of concatenated method names: 'gPg8aH1NlxgXZrUR82TrxnwVLduRbHt2dVldLJuGgFs994sKFtyu8nFxnkX', 'N1OEkRyv1WdRTBlNrukmfNHi3ERZ3eO4WmeQxKPsPO26XP3MBQonn2DCNR4', 'VdGKaqwiCkP0Tks33qXRo7nuwxVSUUf9tiBA6K1JOoQbrwzarSIj2GcIaiW', 'yzTdo5JAiTcUNM4Aax0', '_3JRdxbCXECrBO8cWp5U', 'dKQvkQEsn93bzoDpCKF', 'WDnqeUqzNRllozcHXJE', 'fHaF7qEZzWBcqfNqS7e', 'RkoyrXFtso75SWs1IHl', '_929CGkP8u8LURpOeE4m'
Source: coding.3.dr, Yu8PsOvdqdBbsmzeNGpgYeaKbq1IkYDLsIBLuKmhZZtjtnxFFYKYRxD6IQ7uNip706VKKdVvdgCs6awfVWcW8UNjklxvuEsRjSO.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_2Jt8Ph2JvZovaSM7QmYCVdSg7ZyuQ2FkFy963KddiN3X9L8A7JnSNaAxuY4', 'bDJQlhxE9uVGMuof3JgGqmKhGxfrfyKBb1v57g7bx6d1xRHYvebFgZIOnIF', 'im1C1FexW7Bd7L2OQkItHQHizq52HsiDPAC6mnymzNDW5miKmlsDS63MOTq', '_3Vqn5nXmRx96TYTukVrLEPtqRCRTSP6dTSnfoo6nTIwHRQnfDPm8aQexlNp'
Source: coding.3.dr, 153GVkCW1JSY1j8x1OmHpbOpXJA.cs	High entropy of concatenated method names: 'XRN4Y7KffVBYkqV1gFrkgXj3eyq', 'A489ErlwV9A4dCeG59RzSh9kbzW', 'YOW35931rXD0jFxvxfOXF9qp3e8', 'mdVSAGCsiFQT6SL3QinghcxhUwN', 'VGJj30Tw3qEGKsEE3h70GSWbrnm', 't5UiWvmeSVasrauRTqaeUUbpY6u', 'QqCwprBCyaaw5FD9E6QovodNNCn', 't3bNN1mJNFrbRl2QexvkgxGdlZA', 'Uchszl676AMBmtntJysiVwRXKMQ', 'WIWKuGr40nxtaEQowgzmXtEt7sw'
Source: coding.3.dr, IO1UOhIFtJUrq7FFz6TE95gcPv3vcEtJ2sUCsLDnYmwnk7Bi3nQvt8hBnnHX1W7MSOynjPXn52SG8fIjMKC9I.cs	High entropy of concatenated method names: '_7a2RgqA4h9MnAhXwwZRFGCTuKaTbSVvm9Sjn3T9Kw8GalL3bRS7w0LkS2zBOikSk8qpod4BfFp2Aq8ykDxe1H', 'TOBkc6FXFu1mw67EbEmLtZT3bCL1ttQJM8I21kaWj3oDXdQQogEP4E4cf1RQqj9vhIMSr3O8IFPUp4yAWp61U', 'U6VuRIYy46vANFFrFNriRe1vuRMNXp4yfMyK5J11ANoNJY5sBBLnXwQvJ1wvBijG2KRNdADDQ4kDcUbwRRC7i', 'mxRTunPLpaCXGaI6NbC3YPGzqeOA40Do4oFrQj9BchoL8FLAy7aPgK5BKu2dDDUrfR7v8DKCWIikofzcOBI6V', 'v7Y7CLj49Hc0KO0TtSvRtwAOjW2iqinnZwJqjlLhoNHQ8aqSODp16t4qdZTMx7q98GETk18n9HrW7SFsIv0LG', 'T0AeetyOPv4yuEworKv76m0DPX7', 'sqHAqdfVLYznRohHd8e6WTbSIui', 'hsVw0xNOYXaqPvUPQAMNUmELmvE', '_0ymHvWrEkrMuSepPI04uwSas8l1', '_3MGGB8dCJwZrZRxGWLv3DqINsLE'
Source: coding.3.dr, OszBM2fJqaqDqfTYb3i92yMDtuZ.cs	High entropy of concatenated method names: 'xidvVpyftr0TARr6SyFK120zke5', 'cazNyFjELr2aaOSrDPPwhvLPef0', 'IV7f8BjbMecOHjAFrQqr92Y8mOZ', 'Ut2E7ioakBwDCnVjl3NrOYK0jlF', 'ap82692bj9sL1IPmzthM4moxbeR', 'EXzqiOLGWwfCjJyCkuly48LErA7', 'rTZBWRw4hmwFzvsBKeTxbJsXcQt', 'OAl0dJLveQummh269wwNXBLNdYG', 'b2JxfhLhtRcQxHcPpDM2IvQTp23', '_0CD003T1QUgHbzgeEcc4mzwtJh9'
Source: coding.3.dr, 6Dhi8Wb4ZsGZiWpniMf0gM4H4sj.cs	High entropy of concatenated method names: 'e97UE8lAKCPtzzsqopGwpI0JZKD', 'C1Mh5FfC46zqSPZLrEHcvHzSszw5cH6CiDvtUGKIDpUhpURHuKGKiKF8OzAdLblC6f5Lv8jYHOhS7', '_6oCtn4yPIrxkQJxr3QxIfOJ7kMolPcw7nrzUKsrQd97b9ujHM8F9Kmdag301HFb9OHeu8oqwPiH3y', 'uMAoFuu71wW7SoYmIBSR9xa7qqFuk08XYBlq7x8S8waGDa5itFDcAy2TYwN2QGpPUM4W2Uig8ViKP', 'EZJgNSBfT283ehB6J38sl27uAj0OHSofO6kngsQGCtS276vFQvCDORrFIe1zFxbAaULmSJTJ5HE3X'
Source: coding.3.dr, Q6RXh22YWFNEsWThUdGyFlXlpv73imik40KVOsv5cQHzChzaLrhtXsFvgTML0HwxoG7yOuzlGFnPqkfILokIJ.cs	High entropy of concatenated method names: 'dWIr7OLiEnuOfkKwsuFLdMQmoC87zAuDww9ykJKUdGKAlD0R29ScllCHtM7GatcTJKDqrhdgfo9nKpeFCAqH4', 'UsPA0yyKrFDT4YMs1WmBxMp71pytyVMBywo9EIlSvZpfXnaT8DAk51OLVk2vY5p8bz3vbLSj6XN1d7DvmCD8C', 'fDHZaLZ51olnlvgTUoW5ZZ1l3jnUgEAyKh981AyB9ob2dFvnoSyXaFhZ2pq6C6IlSXkuVyKl94fSG6kSrWPWQ', 'RPTdjkVwktugaPmgLcahJrBYyUHr6Jhy1QU6dcB17rPoshCrHgoOoaKNoBd0tZ4FyjKI1XTAKib13T9ZVIuts', 'MyivBc7NppTrkV9ty2QHprAhfg8m2I527EC6KeKTYaWCWRRTyIbhCCIU0USUvJhxoustt81iXZUCbSCZIER40', 'bakjUV2m6vbJ6toUEYH1cAAIHcGysvBzRxDl9YPFcYtbevevL5R9r6JoiWhD2bWV9KOyZpbSdFfP1uBRU7awH', '_6BeUae8tSbCFeb4NGv5b9ih1XspUQpbSF0BBVp6VOkWRlYcP6h2pyQWr35NXAbIqJPMDCkQvlXCZXY6DB0tjQ', 'tE0AsQgAwdQqiO8BDrQr5ZcYkg9tfb3e0TR6YLjCXb5SiDthmhMzthas1DmOrEt2OYSMOZG9G4TzoAecECpP1', 'DPnUj4NQ5rq9dCZUOuoLGpKPuHkgCiI4kuqac2Ggd9ndTKmHSh2tznYgXYojkYyMjAmxwhoI7QSP3wNZRhVF0', 'p1XOSKQyP9RuZBRNZM1c800jcqppbOVM6Nxs4qMznZvowsLtVFFc8alOkYs1eVy4b7LBprYn6lIb8THZR4BGd'
Source: coding.3.dr, XRg5CXzghacu61mWJVTLzsueymr.cs	High entropy of concatenated method names: 'w1qPaUREO7T8hRMQz9GQxE25SXN', '_2iHgS5h0BqQUHK7TeTnxAOhnVgM', 'nfd6r5aBUpsy7CE8rO9VJhSYMre', 'OeZXC5mjse5URVGoXdFBLFGQ9fy', 'qVPyN3zZ2Fopgul5Iqx', 'PGah0mI29WHAiwuyJSF', 'jMaMzC3giKZVOXKQcg2', 'SX20c3RWuqbp5JbFd3i', 'yKOiYDyRU4P1NXn4R1H', 'Q6O7Um3JjDhLJWjFZkf'
Source: coding.3.dr, R2IfcvgzWekfqbuZeqPv4fujzXh.cs	High entropy of concatenated method names: 'GBUvwHj9hGdSdzf7eHgmiogVZiC', '_6lCL66hhXp3WGaGlAph3qC3UjvD', 'JmPzGWLVMSN6gbqZm5YCWCyMK2U', 'iEGrLLZwRN1c2ldpS01IjrAzd03', 'x0SK5wTlyL2wUlhFiIW7UcxXFpg', 'qRJdGH6fomWzdv4Z32TxPZYLul0', 'wkXGOCFqfXqw5npMP1P60RX0YT1', 'Lqg8Y6rFujCVFRB2iBAczp8YHpp', 'dNT12v4ke3EiYiRWnUDJrH1PALh', 'N03dsuRLQq27QaHq5wD1VjQZpyd'

Source: C:\Users\user\Desktop\24572628.exe	File created: C:\ProgramData\coding			Jump to dropped file
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	File created: C:\Users\user\Desktop\24572628.exe			Jump to dropped file

Source: C:\Users\user\Desktop\24572628.exe

File created: C:\ProgramData\coding

Jump to dropped file

Source: C:\Users\user\Desktop\24572628.exe

File created: C:\ProgramData\coding

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\24572628.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "coding" /tr "C:\ProgramData\coding"

Source: C:\Users\user\Desktop\24572628.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coding.lnk

Source: C:\Users\user\Desktop\24572628.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coding.lnk

Loading BitLocker PowerShell Module

Source: C:\Users\user\Desktop\24572628.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run coding			Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run coding			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\coding	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\24572628.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\24572628.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\24572628.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 24572628.exe, 00000003.00000002.3428603021.00000000025E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: YPzNsfg4nR.exe, 00000000.00000002.2273726750.00000208000A5000.00000004.00000800.00020000.00000000.sdmp, 24572628.exe, 00000003.00000000.2221776118.0000000000342000.00000002.00000001.01000000.00000006.sdmp, coding.3.dr, 24572628.exe.0.dr	Binary or memory string: SBIEDLL.DLLY7WSCZEMVG3SCUE2KEQXU280Z45LZRXBPLAGFMYKOAMGSYZVCJ3QOVQATHWYJKQZYJQFQPTMMQGYFD9IEFKNQ32XQJYVBVQSNHRI8MWCYCJLBQDICU7XN5RMWYDJWWBVMQIHLJZYMV4R2E3INK1OPZMXDPIEODQZN4PGVMODTDY1S9FO5AQQYKZNRTFYJEURF0LIPCFKPBHPW0TP9GLJ5SYGGQ0PQRZFWY3VNU5N7ZXJTAIIF8Y8JWS0JWQZXGGS56FJXVB9KS11CRYB9MO6CFKM44TLLLLSIOLK0SLCFDG5B7OKSXEXUSFEW4DY0SLRAV2DZQOXBAD6DHPJDUVQEYMAE9EONC5N2WIVEPHXYQCHZZMQCFY0EGPQLSXIIH6Y5L7H3DUDMARCGXLVDHHQNY7MLEV9OHL1XX9WMRJQWYLARFRC98RMASSU77R7O9E2T5YWQHBWRCEDZE7DZVEGE8JZJNMKWQRTMZ3RVO4YWDSXA5PYEJSGHLMJ4TM4KJEOSUGK5ZQ2LVDMLBGSACRI4FHA70WWYFHEAXGJPVRPIMMIJ7OQS4FQTQTCW3RLPMDRQPSXCUZYAYZR7FPXJHQBRZ07BCWMY6T8E1CGIAFO8YT6XGFWQTSCMLINFO

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Memory allocated: 20868E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Memory allocated: 2086A700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Memory allocated: A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Memory allocated: 1A5E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\coding	Memory allocated: 670000 memory reserve \| memory write watch
Source: C:\ProgramData\coding	Memory allocated: 1A430000 memory reserve \| memory write watch
Source: C:\ProgramData\coding	Memory allocated: 12B0000 memory reserve \| memory write watch
Source: C:\ProgramData\coding	Memory allocated: 1AD50000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\coding	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\coding	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\24572628.exe	Window / User API: threadDelayed 9337	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Window / User API: threadDelayed 510	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6223	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3608	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7409	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2189	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7415	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2019	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7418
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2201

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe TID: 7472	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe TID: 5324	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7820	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8084	Thread sleep count: 7409 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8088	Thread sleep count: 2189 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8112	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3180	Thread sleep count: 7415 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4796	Thread sleep count: 2019 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6160	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4072	Thread sleep count: 7418 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4072	Thread sleep count: 2201 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2292	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\ProgramData\coding TID: 3440	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8060	Thread sleep time: -30000s >= -30000s
Source: C:\ProgramData\coding TID: 8072	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\24572628.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\24572628.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\coding	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\coding	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\coding	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\coding	Thread delayed: delay time: 922337203685477

Source: 24572628.exe.0.dr	Binary or memory string: vmware
Source: svchost.exe, 00000013.00000002.3423237128.00000284AE42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: svchost.exe, 00000013.00000002.3424437338.00000284AF858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 24572628.exe, 00000003.00000002.3436634276.000000001B3C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\24572628.exe

Process information queried: ProcessInformation

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Anti Debugging

Source: C:\Users\user\Desktop\24572628.exe

Code function: 3_2_00007FF848A47A81 CheckRemoteDebuggerPresent,

3_2_00007FF848A47A81

Source: C:\Users\user\Desktop\24572628.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\24572628.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\ProgramData\coding	Process token adjusted: Debug
Source: C:\ProgramData\coding	Process token adjusted: Debug

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\24572628.exe'
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\coding'
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\24572628.exe'	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\coding'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\24572628.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\24572628.exe'

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Process created: C:\Users\user\Desktop\24572628.exe "C:\Users\user\Desktop\24572628.exe"	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\24572628.exe'	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '24572628.exe'	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\coding'	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'coding'	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "coding" /tr "C:\ProgramData\coding"	Jump to behavior

Source: 24572628.exe, 00000003.00000002.3428603021.0000000002657000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: 24572628.exe, 00000003.00000002.3428603021.0000000002657000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 24572628.exe, 00000003.00000002.3428603021.0000000002657000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: 24572628.exe, 00000003.00000002.3428603021.0000000002657000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0@
Source: 24572628.exe, 00000003.00000002.3428603021.0000000002657000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe	Queries volume information: C:\Users\user\Desktop\YPzNsfg4nR.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Queries volume information: C:\Users\user\Desktop\24572628.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\24572628.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\ProgramData\coding	Queries volume information: C:\ProgramData\coding VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\ProgramData\coding	Queries volume information: C:\ProgramData\coding VolumeInformation

Source: C:\Users\user\Desktop\YPzNsfg4nR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: 24572628.exe, 00000003.00000002.3436634276.000000001B40E000.00000004.00000020.00020000.00000000.sdmp, 24572628.exe, 00000003.00000002.3436634276.000000001B45A000.00000004.00000020.00020000.00000000.sdmp, 24572628.exe, 00000003.00000002.3436634276.000000001B3C3000.00000004.00000020.00020000.00000000.sdmp, 24572628.exe, 00000003.00000002.3422310755.00000000008E1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\24572628.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\24572628.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\24572628.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 3.0.24572628.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.2221776118.0000000000342000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2273726750.00000208000A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3428603021.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YPzNsfg4nR.exe PID: 7332, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 24572628.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\coding, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\24572628.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 3.0.24572628.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YPzNsfg4nR.exe.208000a6c48.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.2221776118.0000000000342000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2273726750.00000208000A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3428603021.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YPzNsfg4nR.exe PID: 7332, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 24572628.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\coding, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\24572628.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	33 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	551 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Registry Run Keys / Startup Folder	22 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	161 Virtualization/Sandbox Evasion	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	161 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
YPzNsfg4nR.exe	17%	Virustotal	Browse
YPzNsfg4nR.exe	8%	ReversingLabs
YPzNsfg4nR.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\coding	100%	Avira	TR/Spy.Gen
C:\Users\user\Desktop\24572628.exe	100%	Avira	TR/Spy.Gen
C:\ProgramData\coding	100%	Joe Sandbox ML
C:\Users\user\Desktop\24572628.exe	100%	Joe Sandbox ML
C:\ProgramData\coding	92%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
C:\Users\user\Desktop\24572628.exe	92%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Source	Detection	Scanner	Label	Link
https://ion=v4.5n	0%	Avira URL Cloud	safe
usb-alignment.gl.at.ply.gg	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high
usb-alignment.gl.at.ply.gg	147.185.221.21	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
usb-alignment.gl.at.ply.gg	true	Avira URL Cloud: malware	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.19.dr, qmgr.db.19.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2349698693.0000017045FE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2458610974.000001A290075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2614120753.0000021EE0183000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2829582139.000001C115352000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.m	powershell.exe, 00000008.00000002.2481707420.000001A2F4839000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000D.00000002.2688484901.000001C10557B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000004.00000002.2331273020.0000017036199000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2393482194.000001A280228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2520104597.0000021ED0339000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2688484901.000001C10557B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000D.00000002.2688484901.000001C10557B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000004.00000002.2331273020.0000017036199000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2393482194.000001A280228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2520104597.0000021ED0339000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2688484901.000001C10557B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.micom/pkiops/Docs/ry.htm0	powershell.exe, 0000000B.00000002.2639330504.0000021EE8762000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000D.00000002.2829582139.000001C115352000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2349698693.0000017045FE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2458610974.000001A290075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2614120753.0000021EE0183000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2829582139.000001C115352000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000D.00000002.2829582139.000001C115352000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mic	powershell.exe, 0000000B.00000002.2641179501.0000021EE87F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000D.00000002.2829582139.000001C115352000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000013.00000002.3423579528.00000284AE4BF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000013.00000003.3002178502.00000284B3A70000.00000004.00000800.00020000.00000000.sdmp, edb.log.19.dr, qmgr.db.19.dr	false		high
http://crl.micft.cMicRosof	powershell.exe, 0000000B.00000002.2641179501.0000021EE87F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.2331273020.0000017035F71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2393482194.000001A280001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2520104597.0000021ED0111000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2688484901.000001C1052E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.c	powershell.exe, 00000008.00000002.2481707420.000001A2F4839000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ion=v4.5n	powershell.exe, 0000000B.00000002.2639330504.0000021EE878B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	24572628.exe, 00000003.00000002.3428603021.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2331273020.0000017035F71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2393482194.000001A280001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2520104597.0000021ED0111000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2688484901.000001C1052E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000D.00000002.2688484901.000001C10557B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micros	powershell.exe, 00000008.00000002.2481707420.000001A2F4839000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
147.185.221.21	usb-alignment.gl.at.ply.gg	United States		12087	SALSGIVERUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585127
Start date and time:	2025-01-07 05:59:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	YPzNsfg4nR.exe renamed because original name is a hash value
Original Sample Name:	691c8281d68680d1f8966d657bfbcf4d100c7a70d6894493946793cc320623a6.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@24/28@2/3
EGA Information:	Successful, ratio: 12.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 86 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 40.126.32.134, 40.126.32.138, 40.126.32.140, 40.126.32.76, 40.126.32.136, 20.190.160.14, 20.190.160.22, 40.126.32.72, 23.56.254.164, 13.107.246.45, 52.149.20.212, 23.1.237.91
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target YPzNsfg4nR.exe, PID 7332 because it is empty
Execution Graph export aborted for target coding, PID 5384 because it is empty
Execution Graph export aborted for target coding, PID 8084 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2504 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4308 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7704 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8008 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:00:19	API Interceptor	1x Sleep call for process: YPzNsfg4nR.exe modified
00:00:28	API Interceptor	62x Sleep call for process: powershell.exe modified
00:01:27	API Interceptor	76x Sleep call for process: 24572628.exe modified
00:01:37	API Interceptor	2x Sleep call for process: OpenWith.exe modified
00:01:38	API Interceptor	2x Sleep call for process: svchost.exe modified
06:01:28	Task Scheduler	Run new task: coding path: C:\ProgramData\coding
06:01:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run coding C:\ProgramData\coding
06:01:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run coding C:\ProgramData\coding
06:01:45	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coding.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	SAL987656700.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Resource.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	BootstrapperV1.16.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	SharkHack.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	paint.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	X9g8L63QGs.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	KpHYfxnJs6.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	9g9LZNE4bH.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	riFSkYVMKB.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
147.185.221.21	Nurcraft.exe	Get hash	malicious	XWorm	Browse
	Zvas34nq1T.exe	Get hash	malicious	XWorm	Browse
	aoKTzGQSRP.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Get hash	malicious	SheetRat	Browse
	mIURiU8n2P.exe	Get hash	malicious	XWorm	Browse
	PixpFUv4G7.exe	Get hash	malicious	Quasar, XWorm	Browse
	r4RF3TX5Mi.exe	Get hash	malicious	XWorm	Browse
	ra66DSpa.exe	Get hash	malicious	XWorm	Browse
	Q5N7WOpk8J.bat	Get hash	malicious	Unknown	Browse
	NzEsfIiAc0.exe	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	SAL987656700.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Resource.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	BootstrapperV1.16.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	SharkHack.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	paint.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	X9g8L63QGs.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	KpHYfxnJs6.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	9g9LZNE4bH.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	riFSkYVMKB.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	SAL987656700.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Resource.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	BootstrapperV1.16.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	SharkHack.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	paint.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	X9g8L63QGs.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	KpHYfxnJs6.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	9g9LZNE4bH.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	riFSkYVMKB.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
SALSGIVERUS	sela.exe	Get hash	malicious	Njrat	Browse	147.185.221.17
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	BootstrapperV1.16.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	SharkHack.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	avaydna.exe	Get hash	malicious	Njrat	Browse	147.185.221.24
	ddos tool.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	L988Ph5sKX.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	ANuh30XoVu.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	p59UXHJRX3.exe	Get hash	malicious	XenoRAT	Browse	147.185.221.24
	JdYlp3ChrS.exe	Get hash	malicious	Njrat	Browse	147.185.221.24

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306986570839627
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugP:gJjJGtpTq2yv1AuNZRY3diu8iBVqFl
MD5:	8ABC3C15385F6D906DDA7E590F452109
SHA1:	7D117E7F8DBBD2F633DF41AF8A76254C89FDBC97
SHA-256:	5D48FBCA13BD6C0EB4DB736FEB84BF82AA72B9F1DBB5E4CBA8607CCD6679DDCD
SHA-512:	826826CAB53E2AD15FE0FFC328CDC319483F7E15D7DB20B6FCAE13DD96B2818AC42F9762BA7CB065BB5C7828017FAFE6FAB0CEDA6094136E3A8F186034BC92F4
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf50580ab, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585129248590262
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	87F796CC76262B0391D1D761DC2D7679
SHA1:	D8D62E8BBCFCF6CB68E479F0AD9F32A5E4DBF10E
SHA-256:	CF50BC048AFA31C6F52099E7F92439771513C9A1408EA724CD7CF41F059D36D7
SHA-512:	7EE62067622F93E808E02202CB55BC7F79D0EFB7D7804788D404718B744C13CC38C9E1575CC972CB7CF1E30CDAAF6B9111605468C5759AA65995FCA7AABC87F4
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z..........{..&....}i.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................9&....}i....................4&....}i..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0811685372172786
Encrypted:	false
SSDEEP:	3:H4tlKYe0MqmkbGuAJkhvekl1ogiqz/l/ollrekGltll/SPj:YKzB7GrxlCnelAJe3l
MD5:	3D64F21AF3E3AA040948D0375FFC3321
SHA1:	5648097E4332C01A777334E4F22259F937019034
SHA-256:	DAC8A750286465C2A4D10BDB8E434D4CB92F18A0F5203803DC1991AD7050CAF9
SHA-512:	EC59FFACD5B3D75E8B308699D34DADD7DCF07E61D599ABB038EF02A8F29B6292C301B9916BCAF069F0DD59809D3307D53D32DB25FAFF27187588C2E7C6A64B8D
Malicious:	false
Preview:	........................................;...{..&....}i......{...............{.......{...XL......{.....................4&....}i.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\coding

Process:	C:\Users\user\Desktop\24572628.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	5.94947504067525
Encrypted:	false
SSDEEP:	1536:z1fsaWa6B6zIJgfxtrjSvbqpU+CgEEL6DQrGR8mOOrxkajucVB:RfsaWajIJi6bq2lEprGiONkaju+B
MD5:	FFD51738DC3483954A7BCDFAF713DB10
SHA1:	3B643A4AD443A5EF249B1C02D0CDB927F5AE38E6
SHA-256:	6A2BDC82837DA65C36AF89091F9B1282AE735DED04985BA44759466E4F47C394
SHA-512:	67B5AC3FDB9C771F13603D9D78461751172A71EB6B236A55A7BA9C51D96B98C79A615D13F677317189007BA24F452B1B53B31356ACB25913BCEEA6313D84D452
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\ProgramData\coding, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ProgramData\coding, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\ProgramData\coding, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\ProgramData\coding, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.............................<... ...@....@.. ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H........b..........&.....................................................(.....r...p. C~....(.....ry..p. .....s.........s.........s.........s..........r...p. y."..ri..p. .....r...p. p{..rY..p. .O...r...p. /?....((....r!..p. .H...r{..p. ..e..(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(Z..."(....+.&(....&+..+5sk... .... .'..ol...(,...~....-.(_...(Q...~....om...&.-..r...p. S....r?..p.r...p. 9/T..r...p. .....rM..p. E/...r...p. .....r...p.r[.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\YPzNsfg4nR.exe.log

Process:	C:\Users\user\Desktop\YPzNsfg4nR.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.357964438493834
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khav:ML9E4KQwKDE4KGKZI6Khk
MD5:	D8F8A79B5C09FCB6F44E8CFFF11BF7CA
SHA1:	669AFE705130C81BFEFECD7CC216E6E10E72CB81
SHA-256:	91B010B5C9F022F3449F161425F757B276021F63B024E8D8ED05476509A6D406
SHA-512:	C95CB5FC32843F555EFA7CCA5758B115ACFA365A6EEB3333633A61CA50A90FEFAB9B554C3776FFFEA860FEF4BF47A6103AFECF3654C780287158E2DBB8137767
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\coding.log

Process:	C:\ProgramData\coding
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\Users\user\Desktop\24572628.exe
File Type:	Generic INItialization configuration [WIN]
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.6722687970803873
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr42VjFYJKXzovuEXn:EFYJKDoWr5FYJKDoG+n
MD5:	DE63D53293EBACE29F3F54832D739D40
SHA1:	1BC3FEF699C3C2BB7B9A9D63C7E60381263EDA7F
SHA-256:	A86BA2FC02725E4D97799A622EB68BF2FCC6167D439484624FA2666468BBFB1B
SHA-512:	10AB83C81F572DBAA99441D2BFD8EC5FF1C4BA84256ACDBD24FEB30A33498B689713EBF767500DAAAD6D188A3B9DC970CF858A6896F4381CEAC1F6A74E1603D0
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]....### explorer ###..r[WIN]r

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2h55bruw.tem.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3agkul3e.q0v.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_45jajqpv.ckk.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4tj4wwl5.pd0.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5fcblpik.4c5.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aee5afo4.uam.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dw41akkw.p12.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gugco2nd.yne.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h3rb1oi3.w4v.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h3ungc3s.f10.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iwnlhlwi.10n.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jskv5t0y.1fj.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ltcfqr50.vy1.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oypyvajq.kx3.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pi4myg1x.5cx.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zd1ndczj.wtr.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coding.lnk

Process:	C:\Users\user\Desktop\24572628.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Jan 7 04:01:27 2025, mtime=Tue Jan 7 04:01:27 2025, atime=Tue Jan 7 04:01:27 2025, length=75776, window=hide
Category:	dropped
Size (bytes):	634
Entropy (8bit):	4.580394979814711
Encrypted:	false
SSDEEP:	6:4xtQlXXMf+RcMreiXuhEtHGCF1qS4pWJ0ljAlPtvfUSD6bhEZGx2/miUymoy0nJb:8WMf+Rcm9ueUS+ccjAhfZGbNxgU1dmV
MD5:	4B1396A1A29DE951C146ABFA0F127DA6
SHA1:	8AC6AF8223CB23D28BA1CD83BC9132B3BA8ACF6A
SHA-256:	A8C22C39AEF3E951EECCFC6F3BA9E2015EADC12966B200B69702E6759FEE2DDB
SHA-512:	4E63D5C2DC36C226A2F18B0E5596BF7F8045B37A884E2280030CC021B71561B82CC137BD5CA4A68963752D309DDC9F669C31EB24E1851946ACC1DFA535D3C541
Malicious:	false
Preview:	L..................F.... ..fU.4.`..fU.4.`..fU.4.`...(...........................P.O. .:i.....+00.../C:\...................`.1.....'Z.(. PROGRA~3..H......O.I'Z.(....g........................P.r.o.g.r.a.m.D.a.t.a.....T.2..(..'Z.( coding..>......'Z.('Z.(.....)........................c.o.d.i.n.g.......D...............-.......C............I.6.....C:\ProgramData\coding..-.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m.D.a.t.a.\.c.o.d.i.n.g.`.......X.......181598...........hT..CrF.f4... ..qX.....,...W..hT..CrF.f4... ..qX.....,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\Desktop\24572628.exe

Process:	C:\Users\user\Desktop\YPzNsfg4nR.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	5.94947504067525
Encrypted:	false
SSDEEP:	1536:z1fsaWa6B6zIJgfxtrjSvbqpU+CgEEL6DQrGR8mOOrxkajucVB:RfsaWajIJi6bq2lEprGiONkaju+B
MD5:	FFD51738DC3483954A7BCDFAF713DB10
SHA1:	3B643A4AD443A5EF249B1C02D0CDB927F5AE38E6
SHA-256:	6A2BDC82837DA65C36AF89091F9B1282AE735DED04985BA44759466E4F47C394
SHA-512:	67B5AC3FDB9C771F13603D9D78461751172A71EB6B236A55A7BA9C51D96B98C79A615D13F677317189007BA24F452B1B53B31356ACB25913BCEEA6313D84D452
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\Desktop\24572628.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\Desktop\24572628.exe, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\Users\user\Desktop\24572628.exe, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\Desktop\24572628.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.............................<... ...@....@.. ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H........b..........&.....................................................(.....r...p. C~....(.....ry..p. .....s.........s.........s.........s..........r...p. y."..ri..p. .....r...p. p{..rY..p. .O...r...p. /?....((....r!..p. .H...r{..p. ..e..(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(Z..."(....+.&(....&+..+5sk... .... .'..ol...(,...~....-.(_...(Q...~....om...&.-..r...p. S....r?..p.r...p. 9/T..r...p. .....rM..p. E/...r...p. .....r...p.r[.

C:\Users\user\Desktop\xxx.log

Process:	C:\Users\user\Desktop\YPzNsfg4nR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	1.2516291673878228
Encrypted:	false
SSDEEP:	3:i:i
MD5:	8CE415126388942B00CCF21460675DFE
SHA1:	7429BD9C85859C88720A23206E62FF9FA5E078ED
SHA-256:	AF0C5ABBE62B24372BC89B5EBBECDA85F17EB51B1DAA8BB300D8336885396B29
SHA-512:	0DF196F8BCA531389D99C5435545509260AF25619BDEE894B05B7EEC78D076703540A13C0D076DCE0F5AFF57BC1AB83675E1AA6291A6151AC1891B6ED64AF750
Malicious:	false
Preview:	0000..

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.978930596680155
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	YPzNsfg4nR.exe
File size:	209'408 bytes
MD5:	47f35ed89ba0b7756cc4d268e7516f55
SHA1:	714b90afdccaee669f5e2edd1b8680c4631cffa0
SHA256:	691c8281d68680d1f8966d657bfbcf4d100c7a70d6894493946793cc320623a6
SHA512:	248494a501923a303c540fcf6d2ce42af2ece7fc48fd236c344d7d809df0c978468067ac2cf6d8699cb5635273cce84e630ab9d5ee9d2025abc1d407915600b0
SSDEEP:	6144:MtajSmYx6g7Fn/hZR9ICPtajSmYx6g7Fn/hZR9IC:yajPYx6g7FnXYUajPYx6g7FnXY
TLSH:	F624F1BA84E45437C84416F64EBD6FB18AD7F44E02538CF99AB0D8F544B2764C6F7888
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....a............"...0..*............... .....@..... ....................................`...@......@............... .....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140000000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA7BF61F9 [Sat Mar 8 08:25:29 2059 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x36000	0x578	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x347f0	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x328f0	0x32a00	a10b7a436dbe7a44139d74bacb67dd0b	False	0.9693672839506173	data	7.988299230220677	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x36000	0x578	0x600	255a5c29385a2b32359b609451859123	False	0.3977864583333333	data	4.068795341618418	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x36090	0x2e8	data			0.4153225806451613
RT_MANIFEST	0x36388	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-07T06:01:39.003798+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.5	49999	147.185.221.21	39219	TCP
2025-01-07T06:02:05.111357+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.5	50007	147.185.221.21	39219	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 06:00:26.587495089 CET	49743	80	192.168.2.5	208.95.112.1
Jan 7, 2025 06:00:26.592451096 CET	80	49743	208.95.112.1	192.168.2.5
Jan 7, 2025 06:00:26.594413996 CET	49743	80	192.168.2.5	208.95.112.1
Jan 7, 2025 06:00:26.594882011 CET	49743	80	192.168.2.5	208.95.112.1
Jan 7, 2025 06:00:26.599735022 CET	80	49743	208.95.112.1	192.168.2.5
Jan 7, 2025 06:00:27.084784031 CET	80	49743	208.95.112.1	192.168.2.5
Jan 7, 2025 06:00:27.126354933 CET	49743	80	192.168.2.5	208.95.112.1
Jan 7, 2025 06:01:28.060178995 CET	49999	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:01:28.065088987 CET	39219	49999	147.185.221.21	192.168.2.5
Jan 7, 2025 06:01:28.065182924 CET	49999	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:01:28.112932920 CET	49999	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:01:28.117738008 CET	39219	49999	147.185.221.21	192.168.2.5
Jan 7, 2025 06:01:39.003798008 CET	49999	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:01:39.113607883 CET	39219	49999	147.185.221.21	192.168.2.5
Jan 7, 2025 06:01:40.861277103 CET	80	49743	208.95.112.1	192.168.2.5
Jan 7, 2025 06:01:40.861371994 CET	49743	80	192.168.2.5	208.95.112.1
Jan 7, 2025 06:01:49.457283974 CET	39219	49999	147.185.221.21	192.168.2.5
Jan 7, 2025 06:01:49.457443953 CET	49999	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:01:50.860858917 CET	49999	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:01:50.865427971 CET	50007	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:01:50.865652084 CET	39219	49999	147.185.221.21	192.168.2.5
Jan 7, 2025 06:01:50.870234966 CET	39219	50007	147.185.221.21	192.168.2.5
Jan 7, 2025 06:01:50.870326996 CET	50007	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:01:50.910499096 CET	50007	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:01:50.915326118 CET	39219	50007	147.185.221.21	192.168.2.5
Jan 7, 2025 06:02:05.111356974 CET	50007	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:02:05.116173983 CET	39219	50007	147.185.221.21	192.168.2.5
Jan 7, 2025 06:02:07.112608910 CET	49743	80	192.168.2.5	208.95.112.1
Jan 7, 2025 06:02:07.117444992 CET	80	49743	208.95.112.1	192.168.2.5
Jan 7, 2025 06:02:12.252716064 CET	39219	50007	147.185.221.21	192.168.2.5
Jan 7, 2025 06:02:12.252789021 CET	50007	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:02:14.595351934 CET	50007	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:02:14.596678972 CET	50010	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:02:14.600214958 CET	39219	50007	147.185.221.21	192.168.2.5
Jan 7, 2025 06:02:14.601567984 CET	39219	50010	147.185.221.21	192.168.2.5
Jan 7, 2025 06:02:14.601660967 CET	50010	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:02:14.668013096 CET	50010	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:02:14.672894001 CET	39219	50010	147.185.221.21	192.168.2.5
Jan 7, 2025 06:02:23.298557043 CET	50010	39219	192.168.2.5	147.185.221.21
Jan 7, 2025 06:02:23.303500891 CET	39219	50010	147.185.221.21	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 06:00:26.559282064 CET	52766	53	192.168.2.5	1.1.1.1
Jan 7, 2025 06:00:26.565876007 CET	53	52766	1.1.1.1	192.168.2.5
Jan 7, 2025 06:01:28.023303986 CET	50484	53	192.168.2.5	1.1.1.1
Jan 7, 2025 06:01:28.055989981 CET	53	50484	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 06:00:26.559282064 CET	192.168.2.5	1.1.1.1	0xd2cc	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 06:01:28.023303986 CET	192.168.2.5	1.1.1.1	0x4174	Standard query (0)	usb-alignment.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 06:00:26.565876007 CET	1.1.1.1	192.168.2.5	0xd2cc	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 7, 2025 06:01:28.055989981 CET	1.1.1.1	192.168.2.5	0x4174	No error (0)	usb-alignment.gl.at.ply.gg		147.185.221.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49743	208.95.112.1	80	7544	C:\Users\user\Desktop\24572628.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 06:00:26.594882011 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jan 7, 2025 06:00:27.084784031 CET	175	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 05:00:26 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	00:00:15
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\YPzNsfg4nR.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\YPzNsfg4nR.exe"
Imagebase:	0x20868a90000
File size:	209'408 bytes
MD5 hash:	47F35ED89BA0B7756CC4D268E7516F55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2273726750.00000208000A5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2273726750.00000208000A5000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	00:00:15
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	00:00:20
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\24572628.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\24572628.exe"
Imagebase:	0x340000
File size:	75'776 bytes
MD5 hash:	FFD51738DC3483954A7BCDFAF713DB10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000000.2221776118.0000000000342000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000000.2221776118.0000000000342000.00000002.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.3428603021.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\Desktop\24572628.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\Desktop\24572628.exe, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\Users\user\Desktop\24572628.exe, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\Desktop\24572628.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	00:00:27
Start date:	07/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\24572628.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	00:00:27
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	00:00:34
Start date:	07/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '24572628.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	00:00:34
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	00:00:47
Start date:	07/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\coding'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	00:00:47
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	00:01:03
Start date:	07/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'coding'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	00:01:03
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	00:01:27
Start date:	07/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "coding" /tr "C:\ProgramData\coding"
Imagebase:	0x7ff7b1660000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	00:01:27
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	00:01:28
Start date:	07/01/2025
Path:	C:\ProgramData\coding
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\coding
Imagebase:	0x130000
File size:	75'776 bytes
MD5 hash:	FFD51738DC3483954A7BCDFAF713DB10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\ProgramData\coding, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ProgramData\coding, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\ProgramData\coding, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\ProgramData\coding, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Has exited:	true

Target ID:	18
Start time:	00:01:37
Start date:	07/01/2025
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff7959f0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	00:01:37
Start date:	07/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	20
Start time:	00:01:45
Start date:	07/01/2025
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff7959f0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	00:02:01
Start date:	07/01/2025
Path:	C:\ProgramData\coding
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\coding
Imagebase:	0xb60000
File size:	75'776 bytes
MD5 hash:	FFD51738DC3483954A7BCDFAF713DB10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true