Windows Analysis Report
PixpFUv4G7.exe

Overview

General Information

Sample name: PixpFUv4G7.exe
renamed because original name is a hash value
Original sample name: 066cffd2ba05642d4bcadf466fa00ba50210b6aed526c07382924c7aaece384e.exe
Analysis ID: 1527486
MD5: 75c7da1457f052ae8aa48571898d4094
SHA1: b851a0ba41ced091fd775b72c91b329d387cdeff
SHA256: 066cffd2ba05642d4bcadf466fa00ba50210b6aed526c07382924c7aaece384e
Tags: exeuser-Chainskilabs
Infos:

Detection

Quasar, XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Quasar RAT
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Protects its processes via BreakOnTermination flag
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Use Short Name Path in Command Line
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: PixpFUv4G7.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Avira: detection malicious, Label: TR/Spy.Gen
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Avira: detection malicious, Label: TR/Spy.Gen
Found malware configuration
Source: 00000001.00000002.2504673520.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": ["content-portion.gl.at.ply.gg"], "Port": "47900", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mech Server.exe ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Quasar.Common.dll ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin ReversingLabs: Detection: 72%
Multi AV Scanner detection for submitted file
Source: PixpFUv4G7.exe ReversingLabs: Detection: 71%
Yara detected Quasar RAT
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Quasar.Common.dll, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Profiles\Default.xml, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mech Server.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin, type: DROPPED
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.1% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mech Server.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: PixpFUv4G7.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 1.0.Copilot.exe.960000.0.unpack String decryptor: content-portion.gl.at.ply.gg
Source: 1.0.Copilot.exe.960000.0.unpack String decryptor: 47900
Source: 1.0.Copilot.exe.960000.0.unpack String decryptor: <123456789>
Source: 1.0.Copilot.exe.960000.0.unpack String decryptor: <Xwormmm>
Source: 1.0.Copilot.exe.960000.0.unpack String decryptor: Ratted
Source: 1.0.Copilot.exe.960000.0.unpack String decryptor: USB.exe
Source: 1.0.Copilot.exe.960000.0.unpack String decryptor: %Temp%
Source: 1.0.Copilot.exe.960000.0.unpack String decryptor: Microsoft Copilot.exe
Uses 32bit PE files
Source: PixpFUv4G7.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Windows\SysWOW64\unarchiver.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll Jump to behavior
Source: Binary string: 10/06/2024 6:53 PM: File is empty: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1283269927.0000000002A7A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: -QlONC:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1283269927.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, unarchiver.exe, 00000003.00000002.1283269927.0000000002A7A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: -Ql^]File is empty: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1283269927.0000000002A7A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: -Qlts10/06/2024 6:53 PM: File is empty: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1283269927.0000000002A7A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\src\TestFramework\Extension.Desktop\obj\Release\Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.pdb source: Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll.4.dr
Source: Binary string: D:\a\_work\1\s\src\Adapter\MSTest.CoreAdapter\obj\Release\Microsoft.VisualStudio.TestPlatform.MSTest.TestAdapter.pdb source: Microsoft.VisualStudio.TestPlatform.MSTest.TestAdapter.dll.4.dr
Source: Binary string: C:\projects\globalmousekeyhook\MouseKeyHook\obj\Debug\Gma.System.MouseKeyHook.pdb source: Gma.System.MouseKeyHook.dll.4.dr
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1282275364.0000000000B1D000.00000004.00000020.00020000.00000000.sdmp, 7za.exe, 00000004.00000002.1276652478.0000000000698000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: assembly_.dll.pdbR source: Microsoft.VisualStudio.CodeCoverage.Shim.dll.4.dr
Source: Binary string: MONOCE~3.DLLMono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1282275364.0000000000B45000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdbSHA256 source: 7za.exe, 00000004.00000003.1276298878.0000000000680000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: BouncyCastle.Crypto.pdbSHA256 source: BouncyCastle.Crypto.dll.4.dr
Source: Binary string: /_/artifacts/obj/Microsoft.VisualStudio.Coverage.Shim/Release/net35/Microsoft.VisualStudio.CodeCoverage.Shim.pdb source: Microsoft.VisualStudio.CodeCoverage.Shim.dll.4.dr
Source: Binary string: /_/artifacts/obj/Microsoft.VisualStudio.Coverage.Shim/Release/net35/Microsoft.VisualStudio.CodeCoverage.Shim.pdbe+ source: Microsoft.VisualStudio.CodeCoverage.Shim.dll.4.dr
Source: Binary string: Mech RAT/Mono.Cecil.Pdb.dll source: 7za.exe, 00000004.00000002.1276813409.0000000002265000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Mono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1283269927.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, unarchiver.exe, 00000003.00000002.1283269927.0000000002A7A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\src\TestFramework\MSTest.Core\obj\Release\Microsoft.VisualStudio.TestPlatform.TestFramework.pdb source: Microsoft.VisualStudio.TestPlatform.TestFramework.dll.4.dr
Source: Binary string: D:\a\_work\1\s\src\Adapter\PlatformServices.Desktop.Legacy\obj\Release\Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.pdb source: Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll.4.dr
Source: Binary string: cil.Pdb.j source: 7za.exe, 00000004.00000002.1276813409.0000000002265000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb source: 7za.exe, 00000004.00000003.1276298878.0000000000680000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: Mech RAT/Mono.Cecil.Pdb.dll0] source: 7za.exe, 00000004.00000002.1276813409.0000000002265000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: cil.Pdb. source: 7za.exe, 00000004.00000002.1276813409.0000000002265000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\src\Adapter\PlatformServices.Desktop.Legacy\obj\Release\Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.pdbl source: Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll.4.dr
Source: Binary string: BouncyCastle.Crypto.pdb source: BouncyCastle.Crypto.dll.4.dr
Source: Binary string: .pdb;Pdb file found for path '{0}' source: Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll.4.dr

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.7:49973 -> 147.185.221.21:47900
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: content-portion.gl.at.ply.gg
Yara detected Generic Downloader
Source: Yara match File source: 1.0.Copilot.exe.960000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\Copilot.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mech Server.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Guna.UI2.dll, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin, type: DROPPED
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49971 -> 147.185.221.21:47900
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View IP Address: 147.185.221.21 147.185.221.21
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View ASN Name: SALSGIVERUS SALSGIVERUS
May check the online IP address of the machine
Source: unknown DNS query: name: ip-api.com
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: global traffic DNS traffic detected: DNS query: content-portion.gl.at.ply.gg
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: powershell.exe, 00000015.00000002.1843224693.00000205D189C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.m
Source: powershell.exe, 00000013.00000002.1629544454.00000204C320A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.mi
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: PixpFUv4G7.exe, 00000000.00000002.1258939733.0000000002820000.00000004.00000020.00020000.00000000.sdmp, Copilot.exe, 00000001.00000002.2504673520.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, Copilot.exe, 00000001.00000000.1250594519.0000000000962000.00000002.00000001.01000000.00000005.sdmp, Microsoft Copilot.exe.1.dr String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 0000000C.00000002.1351632078.0000022690255000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1447953532.000002189B856000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1613594243.00000204BADF3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1816529970.00000205C9551000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0H
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0I
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: powershell.exe, 00000015.00000002.1681415702.00000205B9709000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000C.00000002.1333585474.0000022680409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1390032359.000002188BA0A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1507799351.00000204AAFAA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1681415702.00000205B9709000.00000004.00000800.00020000.00000000.sdmp, Open.Nat.dll.4.dr String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: Open.Nat.dll.4.dr String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Copilot.exe, 00000001.00000002.2504673520.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1333585474.00000226801E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1390032359.000002188B7E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1507799351.00000204AAD81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1681415702.00000205B94E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000C.00000002.1333585474.0000022680409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1390032359.000002188BA0A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1507799351.00000204AAFAA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1681415702.00000205B9709000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000015.00000002.1681415702.00000205B9709000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: powershell.exe, 00000010.00000002.1461828423.00000218A3D20000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1463069808.00000218A3F15000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1850332223.00000205D1B7D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1846070427.00000205D1980000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 0000000C.00000002.1333585474.00000226801E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1390032359.000002188B7E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1507799351.00000204AAD81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1681415702.00000205B94E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: client.bin.4.dr String found in binary or memory: https://api.ipify.org/
Source: powershell.exe, 00000015.00000002.1816529970.00000205C9551000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000015.00000002.1816529970.00000205C9551000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000015.00000002.1816529970.00000205C9551000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000015.00000002.1681415702.00000205B9709000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: Open.Nat.dll.4.dr String found in binary or memory: https://github.com/lontivero/Open.Nat/issuesOAlso
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: https://github.com/novotnyllc/bc-csharp
Source: powershell.exe, 00000013.00000002.1637714732.00000204C340C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ion=v4.5
Source: client.bin.4.dr String found in binary or memory: https://ipwho.is/
Source: powershell.exe, 0000000C.00000002.1351632078.0000022690255000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1447953532.000002189B856000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.1613594243.00000204BADF3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1816529970.00000205C9551000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: client.bin.4.dr String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: client.bin.4.dr String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: client.bin.4.dr String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot
Source: BouncyCastle.Crypto.dll.4.dr String found in binary or memory: https://www.digicert.com/CPS0

E-Banking Fraud
barindex
Yara detected Quasar RAT
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Quasar.Common.dll, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Profiles\Default.xml, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mech Server.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin, type: DROPPED

Operating System Destruction
barindex
Protects its processes via BreakOnTermination flag
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: 01 00 00 00 Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.0.Copilot.exe.960000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1258939733.0000000002820000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000000.1250594519.0000000000962000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Quasar.Common.dll, type: DROPPED Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mech Server.exe, type: DROPPED Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin, type: DROPPED Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin, type: DROPPED Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin, type: DROPPED Matched rule: Detects Quasar infostealer Author: ditekshen
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Code function: 1_2_00007FFAACB36E42 1_2_00007FFAACB36E42
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Code function: 1_2_00007FFAACB32361 1_2_00007FFAACB32361
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Code function: 1_2_00007FFAACB316E9 1_2_00007FFAACB316E9
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Code function: 1_2_00007FFAACB36096 1_2_00007FFAACB36096
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Code function: 1_2_00007FFAACB320C1 1_2_00007FFAACB320C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 21_2_00007FFAACB2264D 21_2_00007FFAACB2264D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 21_2_00007FFAACB20FDD 21_2_00007FFAACB20FDD
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 28_2_00007FFAACB50E5E 28_2_00007FFAACB50E5E
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 28_2_00007FFAACB516E9 28_2_00007FFAACB516E9
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 28_2_00007FFAACB520C1 28_2_00007FFAACB520C1
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 29_2_00007FFAACB20E5E 29_2_00007FFAACB20E5E
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 29_2_00007FFAACB216E9 29_2_00007FFAACB216E9
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 29_2_00007FFAACB220C1 29_2_00007FFAACB220C1
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 30_2_00007FFAACB20E5E 30_2_00007FFAACB20E5E
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 30_2_00007FFAACB216E9 30_2_00007FFAACB216E9
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 30_2_00007FFAACB220C1 30_2_00007FFAACB220C1
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 31_2_00007FFAACB40E5E 31_2_00007FFAACB40E5E
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 31_2_00007FFAACB416E9 31_2_00007FFAACB416E9
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 31_2_00007FFAACB420C1 31_2_00007FFAACB420C1
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\BouncyCastle.Crypto.dll E51721DC0647F4838B1ABC592BD95FD8CB924716E8A64F83D4B947821FA1FA42
Sample file is different than original file name gathered from version info
Source: PixpFUv4G7.exe, 00000000.00000002.1257409990.0000000000D09000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameunarchiver.exe8 vs PixpFUv4G7.exe
Source: PixpFUv4G7.exe, 00000000.00000002.1258939733.0000000002820000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCopilot.exe4 vs PixpFUv4G7.exe
Uses 32bit PE files
Source: PixpFUv4G7.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Yara signature match
Source: 1.0.Copilot.exe.960000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1258939733.0000000002820000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000000.1250594519.0000000000962000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Quasar.Common.dll, type: DROPPED Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mech Server.exe, type: DROPPED Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin, type: DROPPED Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin, type: DROPPED Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin, type: DROPPED Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: Quasar.resources.dll.4.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Copilot.exe.0.dr, B3zcabB7XoB8QXLIvPnRn2YDu9xmAE9D74ryQl5aeoExBKaOuDeqEaBwEUZtkehlmkcYuEcSIVcgJyj66csaO6q.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Copilot.exe.0.dr, B3zcabB7XoB8QXLIvPnRn2YDu9xmAE9D74ryQl5aeoExBKaOuDeqEaBwEUZtkehlmkcYuEcSIVcgJyj66csaO6q.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Copilot.exe.0.dr, o1PUaP6qj5vEhIVxGUaUdQDcJ68N7eDS7RtJXgQQQQD6rKQdDpNHgsbQgjpqmJNSRQZ6VoSP6jCdrk7Id0L2ih4.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Microsoft Copilot.exe.1.dr, B3zcabB7XoB8QXLIvPnRn2YDu9xmAE9D74ryQl5aeoExBKaOuDeqEaBwEUZtkehlmkcYuEcSIVcgJyj66csaO6q.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Microsoft Copilot.exe.1.dr, B3zcabB7XoB8QXLIvPnRn2YDu9xmAE9D74ryQl5aeoExBKaOuDeqEaBwEUZtkehlmkcYuEcSIVcgJyj66csaO6q.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Microsoft Copilot.exe.1.dr, o1PUaP6qj5vEhIVxGUaUdQDcJ68N7eDS7RtJXgQQQQD6rKQdDpNHgsbQgjpqmJNSRQZ6VoSP6jCdrk7Id0L2ih4.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Microsoft Copilot.exe.1.dr, ZIYiiDVMhvKOYrmxRtunl07Jm5X3i5kgpICkSenNgNtMVbi5BeEvi7p.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Microsoft Copilot.exe.1.dr, ZIYiiDVMhvKOYrmxRtunl07Jm5X3i5kgpICkSenNgNtMVbi5BeEvi7p.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Copilot.exe.0.dr, ZIYiiDVMhvKOYrmxRtunl07Jm5X3i5kgpICkSenNgNtMVbi5BeEvi7p.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Copilot.exe.0.dr, ZIYiiDVMhvKOYrmxRtunl07Jm5X3i5kgpICkSenNgNtMVbi5BeEvi7p.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Quasar.Common.dll.4.dr, PayloadReader.cs Suspicious method names: .PayloadReader.ReadInteger
Source: Quasar.Common.dll.4.dr, PayloadReader.cs Suspicious method names: .PayloadReader.ReadBytes
Source: Quasar.Common.dll.4.dr, PayloadReader.cs Suspicious method names: .PayloadReader.ReadMessage
Source: Quasar.Common.dll.4.dr, PayloadReader.cs Suspicious method names: .PayloadReader.Dispose
Source: Quasar.Common.dll.4.dr, PayloadWriter.cs Suspicious method names: .PayloadWriter.WriteInteger
Source: Quasar.Common.dll.4.dr, PayloadWriter.cs Suspicious method names: .PayloadWriter.WriteBytes
Source: Quasar.Common.dll.4.dr, PayloadWriter.cs Suspicious method names: .PayloadWriter.WriteMessage
Source: Quasar.Common.dll.4.dr, PayloadWriter.cs Suspicious method names: .PayloadWriter.Dispose
Source: classification engine Classification label: mal100.troj.evad.winEXE@27/74@2/2
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Copilot.lnk Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1792:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7780:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7552:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Mutant created: \Sessions\1\BaseNamedObjects\CuWTrNEBgjX4AbNx
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03
Source: C:\Users\user\Desktop\PixpFUv4G7.exe File created: C:\Users\user~1\AppData\Local\Temp\Copilot.exe Jump to behavior
Source: PixpFUv4G7.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PixpFUv4G7.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: PixpFUv4G7.exe ReversingLabs: Detection: 71%
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Evasive API call chain: __getmainargs,DecisionNodes,exit
Source: unknown Process created: C:\Users\user\Desktop\PixpFUv4G7.exe "C:\Users\user\Desktop\PixpFUv4G7.exe"
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Process created: C:\Users\user\AppData\Local\Temp\Copilot.exe "C:\Users\user~1\AppData\Local\Temp\Copilot.exe"
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user~1\AppData\Local\Temp\Mech RAT.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd" "C:\Users\user~1\AppData\Local\Temp\Mech RAT.zip"
Source: C:\Windows\SysWOW64\7za.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\Copilot.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Copilot.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft Copilot.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft Copilot" /tr "C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe"
Source: C:\Windows\System32\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe "C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe "C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe "C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe "C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe"
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Process created: C:\Users\user\AppData\Local\Temp\Copilot.exe "C:\Users\user~1\AppData\Local\Temp\Copilot.exe" Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user~1\AppData\Local\Temp\Mech RAT.zip" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\Copilot.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Copilot.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft Copilot.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft Copilot" /tr "C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe" Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd" "C:\Users\user~1\AppData\Local\Temp\Mech RAT.zip" Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe Section loaded: 7z.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: Microsoft Copilot.lnk.1.dr LNK file: ..\..\..\..\..\..\Local\Temp\Microsoft Copilot.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: PixpFUv4G7.exe Static file information: File size 6669824 > 1048576
Source: C:\Windows\SysWOW64\unarchiver.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll Jump to behavior
Source: PixpFUv4G7.exe Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x651000
Source: Binary string: 10/06/2024 6:53 PM: File is empty: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1283269927.0000000002A7A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: -QlONC:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1283269927.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, unarchiver.exe, 00000003.00000002.1283269927.0000000002A7A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: -Ql^]File is empty: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1283269927.0000000002A7A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: -Qlts10/06/2024 6:53 PM: File is empty: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1283269927.0000000002A7A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\src\TestFramework\Extension.Desktop\obj\Release\Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.pdb source: Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll.4.dr
Source: Binary string: D:\a\_work\1\s\src\Adapter\MSTest.CoreAdapter\obj\Release\Microsoft.VisualStudio.TestPlatform.MSTest.TestAdapter.pdb source: Microsoft.VisualStudio.TestPlatform.MSTest.TestAdapter.dll.4.dr
Source: Binary string: C:\projects\globalmousekeyhook\MouseKeyHook\obj\Debug\Gma.System.MouseKeyHook.pdb source: Gma.System.MouseKeyHook.dll.4.dr
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1282275364.0000000000B1D000.00000004.00000020.00020000.00000000.sdmp, 7za.exe, 00000004.00000002.1276652478.0000000000698000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: assembly_.dll.pdbR source: Microsoft.VisualStudio.CodeCoverage.Shim.dll.4.dr
Source: Binary string: MONOCE~3.DLLMono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1282275364.0000000000B45000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdbSHA256 source: 7za.exe, 00000004.00000003.1276298878.0000000000680000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: BouncyCastle.Crypto.pdbSHA256 source: BouncyCastle.Crypto.dll.4.dr
Source: Binary string: /_/artifacts/obj/Microsoft.VisualStudio.Coverage.Shim/Release/net35/Microsoft.VisualStudio.CodeCoverage.Shim.pdb source: Microsoft.VisualStudio.CodeCoverage.Shim.dll.4.dr
Source: Binary string: /_/artifacts/obj/Microsoft.VisualStudio.Coverage.Shim/Release/net35/Microsoft.VisualStudio.CodeCoverage.Shim.pdbe+ source: Microsoft.VisualStudio.CodeCoverage.Shim.dll.4.dr
Source: Binary string: Mech RAT/Mono.Cecil.Pdb.dll source: 7za.exe, 00000004.00000002.1276813409.0000000002265000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Mono.Cecil.Pdb.dll source: unarchiver.exe, 00000003.00000002.1283269927.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, unarchiver.exe, 00000003.00000002.1283269927.0000000002A7A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\src\TestFramework\MSTest.Core\obj\Release\Microsoft.VisualStudio.TestPlatform.TestFramework.pdb source: Microsoft.VisualStudio.TestPlatform.TestFramework.dll.4.dr
Source: Binary string: D:\a\_work\1\s\src\Adapter\PlatformServices.Desktop.Legacy\obj\Release\Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.pdb source: Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll.4.dr
Source: Binary string: cil.Pdb.j source: 7za.exe, 00000004.00000002.1276813409.0000000002265000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb source: 7za.exe, 00000004.00000003.1276298878.0000000000680000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: Mech RAT/Mono.Cecil.Pdb.dll0] source: 7za.exe, 00000004.00000002.1276813409.0000000002265000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: cil.Pdb. source: 7za.exe, 00000004.00000002.1276813409.0000000002265000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\src\Adapter\PlatformServices.Desktop.Legacy\obj\Release\Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.pdbl source: Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll.4.dr
Source: Binary string: BouncyCastle.Crypto.pdb source: BouncyCastle.Crypto.dll.4.dr
Source: Binary string: .pdb;Pdb file found for path '{0}' source: Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll.4.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: Copilot.exe.0.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{XeV05SAXAr6QYciyeuZVfWefpFooLA9VxSbUudYt1T43kGp8g44ScoX.QXqheBYBDWmdO5ql2x6ldCHTvjDXHBVXLPOJUhWFGNDrLowZjRvTjGw,XeV05SAXAr6QYciyeuZVfWefpFooLA9VxSbUudYt1T43kGp8g44ScoX.cR5q1TtwLue4QvaAhV1iKHyksopJYzGaomDuk6SzeHty3O3ErUQuXXa,XeV05SAXAr6QYciyeuZVfWefpFooLA9VxSbUudYt1T43kGp8g44ScoX.iNCiWddRgJ1hoc1d6PshlCL2N1HMp7hK72B14lbH7VgPAkbnpQSSOnD,XeV05SAXAr6QYciyeuZVfWefpFooLA9VxSbUudYt1T43kGp8g44ScoX.EW1OxE6tQp1VXmI1hNg2s8B1w2GTpYd7nBOus30FbmyVyq0LdpGRlbt,B3zcabB7XoB8QXLIvPnRn2YDu9xmAE9D74ryQl5aeoExBKaOuDeqEaBwEUZtkehlmkcYuEcSIVcgJyj66csaO6q.YoDGckt8ud8LlAgWo4LL6xeCEtF3R9MbeNvXcVx3dsfBEz1lDFEGQjzcQp5qQDpKJljz4B4D2wMOarIK4utWq2l()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Copilot.exe.0.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{SOqEAoO1spd2jFbTHwef5qnZZeSVbW68UxmO7TCKmjWbaYLrDSNQ3v3[2],B3zcabB7XoB8QXLIvPnRn2YDu9xmAE9D74ryQl5aeoExBKaOuDeqEaBwEUZtkehlmkcYuEcSIVcgJyj66csaO6q.m0rpAWerNinOiH6Bx9UnxG4vuQsLTg7lNYDDgnKWqNv0c4U9cM3WV9baKJdCRVK3Cijee7O0P(Convert.FromBase64String(SOqEAoO1spd2jFbTHwef5qnZZeSVbW68UxmO7TCKmjWbaYLrDSNQ3v3[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Copilot.exe.0.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { SOqEAoO1spd2jFbTHwef5qnZZeSVbW68UxmO7TCKmjWbaYLrDSNQ3v3[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: Microsoft Copilot.exe.1.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{XeV05SAXAr6QYciyeuZVfWefpFooLA9VxSbUudYt1T43kGp8g44ScoX.QXqheBYBDWmdO5ql2x6ldCHTvjDXHBVXLPOJUhWFGNDrLowZjRvTjGw,XeV05SAXAr6QYciyeuZVfWefpFooLA9VxSbUudYt1T43kGp8g44ScoX.cR5q1TtwLue4QvaAhV1iKHyksopJYzGaomDuk6SzeHty3O3ErUQuXXa,XeV05SAXAr6QYciyeuZVfWefpFooLA9VxSbUudYt1T43kGp8g44ScoX.iNCiWddRgJ1hoc1d6PshlCL2N1HMp7hK72B14lbH7VgPAkbnpQSSOnD,XeV05SAXAr6QYciyeuZVfWefpFooLA9VxSbUudYt1T43kGp8g44ScoX.EW1OxE6tQp1VXmI1hNg2s8B1w2GTpYd7nBOus30FbmyVyq0LdpGRlbt,B3zcabB7XoB8QXLIvPnRn2YDu9xmAE9D74ryQl5aeoExBKaOuDeqEaBwEUZtkehlmkcYuEcSIVcgJyj66csaO6q.YoDGckt8ud8LlAgWo4LL6xeCEtF3R9MbeNvXcVx3dsfBEz1lDFEGQjzcQp5qQDpKJljz4B4D2wMOarIK4utWq2l()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Microsoft Copilot.exe.1.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{SOqEAoO1spd2jFbTHwef5qnZZeSVbW68UxmO7TCKmjWbaYLrDSNQ3v3[2],B3zcabB7XoB8QXLIvPnRn2YDu9xmAE9D74ryQl5aeoExBKaOuDeqEaBwEUZtkehlmkcYuEcSIVcgJyj66csaO6q.m0rpAWerNinOiH6Bx9UnxG4vuQsLTg7lNYDDgnKWqNv0c4U9cM3WV9baKJdCRVK3Cijee7O0P(Convert.FromBase64String(SOqEAoO1spd2jFbTHwef5qnZZeSVbW68UxmO7TCKmjWbaYLrDSNQ3v3[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Microsoft Copilot.exe.1.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { SOqEAoO1spd2jFbTHwef5qnZZeSVbW68UxmO7TCKmjWbaYLrDSNQ3v3[2] }}, (string[])null, (Type[])null, (bool[])null, true)
.NET source code contains potential unpacker
Source: Copilot.exe.0.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs .Net Code: NoJPZsRyXlX4VLHYh6JKql3rYNCh4dcK0igxeyblFJXKVr4bniJgodk System.AppDomain.Load(byte[])
Source: Copilot.exe.0.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs .Net Code: biTyN82QxV5xbgpkHW1cPoyVK0nD8q7L499HMiuf01EQPDbrfVXfdDH System.AppDomain.Load(byte[])
Source: Copilot.exe.0.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs .Net Code: biTyN82QxV5xbgpkHW1cPoyVK0nD8q7L499HMiuf01EQPDbrfVXfdDH
Source: Microsoft Copilot.exe.1.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs .Net Code: NoJPZsRyXlX4VLHYh6JKql3rYNCh4dcK0igxeyblFJXKVr4bniJgodk System.AppDomain.Load(byte[])
Source: Microsoft Copilot.exe.1.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs .Net Code: biTyN82QxV5xbgpkHW1cPoyVK0nD8q7L499HMiuf01EQPDbrfVXfdDH System.AppDomain.Load(byte[])
Source: Microsoft Copilot.exe.1.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs .Net Code: biTyN82QxV5xbgpkHW1cPoyVK0nD8q7L499HMiuf01EQPDbrfVXfdDH
Binary contains a suspicious time stamp
Source: Mono.Cecil.Rocks.dll.4.dr Static PE information: 0xA5EFDE46 [Thu Mar 21 18:24:06 2058 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Code function: 1_2_00007FFAACB3105D push ebx; retf 1_2_00007FFAACB3106A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_00007FFAACA0D2A5 pushad ; iretd 12_2_00007FFAACA0D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_00007FFAACBF2316 push 8B485F94h; iretd 12_2_00007FFAACBF231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 16_2_00007FFAACA2D2A5 pushad ; iretd 16_2_00007FFAACA2D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 16_2_00007FFAACC12316 push 8B485F92h; iretd 16_2_00007FFAACC1231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 16_2_00007FFAACC16A29 pushad ; iretd 16_2_00007FFAACC16A2A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 19_2_00007FFAACA1D2A5 pushad ; iretd 19_2_00007FFAACA1D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 19_2_00007FFAACC02316 push 8B485F93h; iretd 19_2_00007FFAACC0231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 21_2_00007FFAACA0D2A5 pushad ; iretd 21_2_00007FFAACA0D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 21_2_00007FFAACBF2316 push 8B485F94h; iretd 21_2_00007FFAACBF231B
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Code function: 28_2_00007FFAACB500BD pushad ; iretd 28_2_00007FFAACB500C1
Source: Quasar.resources.dll.4.dr Static PE information: section name: .text entropy: 7.523596358740439
Source: Copilot.exe.0.dr, JROk0Eci9ENTX2os2noz7QF7om05s1eNs5Pju7pQ4InncB1gXtsCZxgYXaMKF9CalozBMWsRf.cs High entropy of concatenated method names: 'zzz9kNPiyb347OFJGtsSWd91D8yHTr0DcPDJZuaqGMh9G7wR3ZcZ2mXzj1ovIv5lpJAhjq8Hf', 'w28s5Ov9OqqYWDPyFXgFqg63ybAsYSPVhX1dFiF4pFKh1638a5bkOXhLHduJqgR44opjpE3vi', '_8YhhV8wVsqXuGAtE2GSEM7Sj3Pv1a9NlKzRwyKgLX7pReNlBatJ5Q05paqiBHAubmwuBEWgms', 'v3HOUB0vSVfwYOs', 'kqVaN5oO22jKzuw', 'KTsJUDejD4ay42w', '_07RDr7CEnBMJyFR', '_1MFbc5OhNAEZonG', 'P9D8iU9QmyAimll', 'SQkSF9ifG7BfWqM'
Source: Copilot.exe.0.dr, XeV05SAXAr6QYciyeuZVfWefpFooLA9VxSbUudYt1T43kGp8g44ScoX.cs High entropy of concatenated method names: 'e7gShrsOowb6OBBMuQbZjGo7NiUdJQdWs7ewdeuFfxmj0O1Qq7xIsR8V0szDKqHfZnYtxyLOk', 'i1VhreKaGWaODWzwCS9IJTaJBXnSvTblkQFdctlfezJoJUY0YWyKI7vtqOczGqiG62YgXBmX3', 'FCpqa1ykUc4HCbajI5zt9f44tjtHnmcjyts6XIFfvTdCw73XstgFzu7UAvcyCC5lNleMw24Ic', 'sZoLdrIe8ju684guo2SmBLwV8i0EyDA6FkKvqBFsUN7BgRNoaUbmjyESxiJuIv69zBGoXI3Hb'
Source: Copilot.exe.0.dr, 5OJs19f2uhPfUVeDxLPXHar.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_54vQtaO2du4tmlhYiHsboNIAmKcIDKrwtsicsnyx5TM8XH44VKWhlt226YiJtux1LzuslUzO6', 'xY3jqEnq9kzaWTDJ2c067h0ySl9VKemkcn5DYPaXpaApus8XZn5qAyIBI4jabpSTuOAPlXh4x', '_3w8f2ytK17lQsk8bOZ3KmloYRGbY6ndDPS9ishJeMY57MSHdnowmdrCxZTgghZN8YYHKJKWx7', 'aRTy8dvPWCTwlNEmETpNBCejoJtVaga0BmXLdkXNvw5tUpRCEF4msvSkAlvjcCiRtTLLf4lgJ'
Source: Copilot.exe.0.dr, 5fllQ7pqCcfYdIoqhx96LhArCojSoN2cBZDL1sFXjz7YVNsfr6AQfHO.cs High entropy of concatenated method names: 'GDXchcMtGDkY1Vou9LYvAwf14iS5MdkdpbYOeczPReY8DRo4whLLs4y', 'EYJGL5lDkwuMliNjoq1drYzBaEX6rBXK2AKkp1mKAHboqJEoRIa4ld5', '_61ox06DpfX2PtLLtLZzpiT9L7GUWRrZLjFXndBbotM9sdgtutjYGRSg', '_4AwNxYSdSHwFOJMbp9fy4pR9YV13ciXZ76LFLH7AIHejgj2H2OEJAEj', 'VdHhYqYEYuzQvBx4H2YKkXnCMrhi2SX8Jc1S6QLyMRjCULAqucmJK7l', '_0Q57a8G3DXcwQfFS8pyBEfRDXGzjtG3LKO1hHqFvI1iPDG6AmToNpFJ', '_7lalOXRRoj63ahdWX3HMjGmtgwxBxYVhCygMId9KeaadrHjqjEO47Tv', 'l1nBJcwnAVgjhfQsEq3MZY8KqYmowdcWxtNiCs1zkIJ8sGXDuPjIcFI', 'vN6EVCZnq0d4fHLuBG2ejJ9ZgAgLRHyN2zwTQoc4YFhbCG0zuMpQpmm', '_4Vfu30y4aMEocc6AvnJMiwhbA8gAx2wkvftBh9hihRSNdGz7pSkchEF'
Source: Copilot.exe.0.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs High entropy of concatenated method names: 'Y2DzlIIVnJSnFRdxYcpmN2ErHj5Ro34Q954TsQwyda699iagsRoKgcw', 'NoJPZsRyXlX4VLHYh6JKql3rYNCh4dcK0igxeyblFJXKVr4bniJgodk', 'VJT1HOu7wvydw6VkH0CCNuFbH6L7K8pX0mGF0frZocx11ArWTiToztd', 'EkSCZMVSQnV6DlScrtHGpsvzngeX6YP6blSBEwpkoj8trokbaSU9O3h', 'QNfHtEVuQ2ymP7yzBI4G7ISPtk1vO5fsfzZ82PmDWhlvPFKUiC0ooQj', 'JM65JA1sXick4wXH48WgQlX9Xy8cDCO5Kezo3r9i71jK9BvB3yZ3TuH', 'SSuecDAkyQnK8PFW383yc3vHl9I9HgBMVxikYudDcV0aOWEWSZZdn1O', 'zpIAK1K0RwzI9fu6ymxXTfFi3X5U5e2tgEWXq32bWGIrHso89fFraAI', 'kswgLpNWEa3rrMjudOXStJTf51pJCbLs29f6tVgpPb8ovOzUOm86BE6', '_0pgx9BtiL5nLEsgywMnjeOuDJb6kgzcIFFOq8fZRSSsGcW2EFahEORW'
Source: Copilot.exe.0.dr, ZIYiiDVMhvKOYrmxRtunl07Jm5X3i5kgpICkSenNgNtMVbi5BeEvi7p.cs High entropy of concatenated method names: 'Rh8IOcOZivZ3DrlDLmNIwCsyYHXpIeYkJhJO1QVhNY3tBqg35b7x34B', 'AfdAljf2buztXsx1XiGKdNAkJrgVMTtp4EMR7uAICpcT7nqCTgca8Q8', 'P9V1Ih5rsAV6a1nikxPqNtY9N6jkVXkxW2lPdGgMUdo9lhZRTY7mv1e', 'X25xugaawcC4cTH5I1fWPQz6gzGAMTTZlljlbLrfJcK3v5xG43QKyAj', 'vCV9er41lqc62F3nmnXBywE6aS6SzVQsNadyDnd255XSX4mKLXMaZbQ', '_5vnlwydEsVRKyeSdp46qUI0eDqNoN7NhUxiDX3PqrbSpcLlMwpabjbs', 'GNwINVOMISs71IP8DwssQ1lzeFEWC0LgvzZW4pJVXY085y5qgifsg4g', 'CYfCJqeUrdpt3RyziTjTuvaSiYtTfg85SteeWEhugvkzM6Xsi0PFoB6', 'RQlnXojfaB4AsdGp9fzX0ndZXQBPQqzLVIUn2E9c9c07G9oB3bgcutU', 'pEFfV4LXwLhAXpxsm8ir9L6nGZMyVsn6bBI20ZoBv6xjA1f7iRdtLnF'
Source: Copilot.exe.0.dr, B3zcabB7XoB8QXLIvPnRn2YDu9xmAE9D74ryQl5aeoExBKaOuDeqEaBwEUZtkehlmkcYuEcSIVcgJyj66csaO6q.cs High entropy of concatenated method names: 'wd76gDubxesDbDajQMUcaXkr9pTksJZPBeuflwgSj1MDa2IQvyGjDdSv9ADZ9B6CweGvSTGSShuu5dM4QBeWG9I', 'fNgi7pPBcbsQy9237UndotP16XTPTisnfZZg8aORcJcVHgGDn3t2tW0NOXUa7UXoaHcBEpllHsp7kTiQldFbkJ7', '_7Eq7iOmpU53TTL8OHOAqqdBQz0o3ZyZ3waB5TJ00Uwgl2rc0DeB567MejLOKt9RKQOZnRy7WQ9dDLkrc7kn9Yi9', '_56N8isy8FI1GuJBl0z4C97Exkx9DmPTVhg08FgBnwD2UwJbcT7SIERrN04Ay9U8ARzDTgLxkvHNmDbQF0rCZTGM', '_5rDOO4kboCqyZPyzA2OaLmSQ3MR3CPrXR8kf87WFNwYW1IwjTSowvn26IhLEWcE9buxmmXZqQTVhySOcv1B7qr0', 'MsXc94LEFTYocjklQThny61epluqEyxDUubulPuO0jqRBLShKfjA07v3t6tOfFdmr1MyE3Dx9IhhIiJknVhUQqi', 'RXscBl8tsb4J5B3Hg3HuxHnUrbAItIsyvMVhufxjaU3xmx27h7rA5jB2azQBHcPnq6oXkQWD16BD7wLJyROp5jY', 'iegOmGxTPr28aBjTs1Bpt3gyCSgOA4ldBKs7MHbHTO59fBv6Bk2AgdwazLH2SdZfvgmu3ESMfXjVxFaaiaIP6rJ', '_9SJCwAwqP1bNJ1lxmTucjMgUJ3uVv0E3ADEgYVmlr3OYlPEH5JwxrK44d4eE3Be8DlbiVFOYB2WjaV9KRFiYlGD', '_5dLEcawLxZeFVKZjgpN3wzdhbKaPtDhQOFKyHjPR9MIFsyMgVpijXc15Wr8KIJUPqhdIITTsfWDOeicEZlxZK9o'
Source: Copilot.exe.0.dr, lN9yj0DclvLFRThUfMYKKmx2hzrhxQ13n5kxy2uTP7z60LyMXNHr5aH2jqOLeRa4Pi9le3w24R6tmLaZf8rxnyC.cs High entropy of concatenated method names: 'asG8aK4379S4LVCWeww50ZK1vccCwVCRHCQgD4Ttkcesi7hM1iBGOi0w6QJhyvNQTnOKDpqVArBx7i0J7VfZagn', 'RBotrOTrFq2SH6MOLHscsFYm1gIiFwiw49RstOzq9T2M5c8XngG9XGaDNlMOYiCh9YF8wPXEieU6ro9JXJoZGGd', 'LLvNWppYJwppCewCURVUIOv256OxJFlObOUrrbVbxQ9Jzk9Ud2Dn6sktBMc60ueRNkvbqrgZpCyznX9WES6LIDB', '_1D8H93VJcm5uLul3rV4GmDH5kBITjCt1W72fXJCWAx2mtqvEnbz2GMHGEXmUANIRcamcCVxw9bDxnN5Hn46jKWI', 'GJQCgPL0mJRNm3M', '_4MZQxFDozqVQOs0', 'dFghmN08kbr7QtI', 'wgsKqYmdAb5ZZQI', 't8GUAUDDrhNkhmv', '_2rtGFiKXxe6wvJV'
Source: Copilot.exe.0.dr, 08I4HlpfZvcXgQJn6jhwLOiX5NhqxmSDMQTziisZ5tgE8NeYxznxnl0.cs High entropy of concatenated method names: 'rkhiNPWgaENIbdkCp6mJtdOPN3mFbpQMuPwvi8kf4rGCc2X72CpsDNt', '_59bJb29T3A9eh4GP7lPhvEZDx5CXQKRkNqgJsPN3vWk8rPr3YsWN6q1FQAdkmo7JVizqwY4Bc0hhMF873KwYNxE', '_8SpLtqtxL11qXpFPX0EYNetLlM7tGh5fkVJXBWlIBPqVCCMlqqoEtdyIYiSROIRSFJUCYVze3U7GOgybQJ1GZ4B', '_3tN4sqb7XBF96eyGZbHxv1TWxurThY4vI02UIVrImdNI7ZZ3yxAw34w8MHNp44J9sS1m4qNtxWtJc6cGBgvt2ym', 'UQBh4otD5J4nlDsaVWOkC8ul68K27zQk7FVjcst0hAxOyvXHJZp1hgwAhyK8oAigDYhN5Oc9gu453aovpq1m3EQ', 'lBAkOyFN4esJnd6690p9qvYki7ULS5jkmRPFPFIvZmlkhOv8jdfX7MiLJ4mM2T8AZutZSoxVZ2GtseegPiFKjHL', 'VRPg9HqyC1arRrsr8BoK5OUv9X8pjpUTh10SPJW4GIotpLazNtgLvv04K5DmXcqBXsNNIEcxbeu9H9ZtQzd1hcm', 'ha4EUhVu1mLLH2coeWSfQZrhSfxZJDXOgv2uauPZ6fPKI8yxvygvQVk3CvudwZqQ3Wg3j4guhUTHn1zs5k0Zm9R', 'MwHHezqwVMSNQjjljHaBml7A5yY2DrmHdQCYBX3eVMwOucmz2b2z4FzLzRNtREPUp3VezMRw9HXbwmuBye73QsF', 'RWB6kPdfXI6U1deoBZhLKOdv6VCsya4A9FnQidDywAh6d3DP70QkSqvixLFsG9Yrhns4n3ni5x4aKFRew2wA1Yq'
Source: Copilot.exe.0.dr, o1PUaP6qj5vEhIVxGUaUdQDcJ68N7eDS7RtJXgQQQQD6rKQdDpNHgsbQgjpqmJNSRQZ6VoSP6jCdrk7Id0L2ih4.cs High entropy of concatenated method names: 'bJcJPCY3g4GZB37VXKjWdykXzvKaVcspg6h2Tky5txjBt3vo0IpVM4fOzFGUuvQU0wOVdHT3roVP9VhbXJ8GP5W', 'qbixFGD30WX2pBs', 'YdqRMxdvksPO6bu', 'vafmKXXYFmdgUGo', '_32tQUhdDBDxEIwM'
Source: Microsoft Copilot.exe.1.dr, JROk0Eci9ENTX2os2noz7QF7om05s1eNs5Pju7pQ4InncB1gXtsCZxgYXaMKF9CalozBMWsRf.cs High entropy of concatenated method names: 'zzz9kNPiyb347OFJGtsSWd91D8yHTr0DcPDJZuaqGMh9G7wR3ZcZ2mXzj1ovIv5lpJAhjq8Hf', 'w28s5Ov9OqqYWDPyFXgFqg63ybAsYSPVhX1dFiF4pFKh1638a5bkOXhLHduJqgR44opjpE3vi', '_8YhhV8wVsqXuGAtE2GSEM7Sj3Pv1a9NlKzRwyKgLX7pReNlBatJ5Q05paqiBHAubmwuBEWgms', 'v3HOUB0vSVfwYOs', 'kqVaN5oO22jKzuw', 'KTsJUDejD4ay42w', '_07RDr7CEnBMJyFR', '_1MFbc5OhNAEZonG', 'P9D8iU9QmyAimll', 'SQkSF9ifG7BfWqM'
Source: Microsoft Copilot.exe.1.dr, XeV05SAXAr6QYciyeuZVfWefpFooLA9VxSbUudYt1T43kGp8g44ScoX.cs High entropy of concatenated method names: 'e7gShrsOowb6OBBMuQbZjGo7NiUdJQdWs7ewdeuFfxmj0O1Qq7xIsR8V0szDKqHfZnYtxyLOk', 'i1VhreKaGWaODWzwCS9IJTaJBXnSvTblkQFdctlfezJoJUY0YWyKI7vtqOczGqiG62YgXBmX3', 'FCpqa1ykUc4HCbajI5zt9f44tjtHnmcjyts6XIFfvTdCw73XstgFzu7UAvcyCC5lNleMw24Ic', 'sZoLdrIe8ju684guo2SmBLwV8i0EyDA6FkKvqBFsUN7BgRNoaUbmjyESxiJuIv69zBGoXI3Hb'
Source: Microsoft Copilot.exe.1.dr, 5OJs19f2uhPfUVeDxLPXHar.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_54vQtaO2du4tmlhYiHsboNIAmKcIDKrwtsicsnyx5TM8XH44VKWhlt226YiJtux1LzuslUzO6', 'xY3jqEnq9kzaWTDJ2c067h0ySl9VKemkcn5DYPaXpaApus8XZn5qAyIBI4jabpSTuOAPlXh4x', '_3w8f2ytK17lQsk8bOZ3KmloYRGbY6ndDPS9ishJeMY57MSHdnowmdrCxZTgghZN8YYHKJKWx7', 'aRTy8dvPWCTwlNEmETpNBCejoJtVaga0BmXLdkXNvw5tUpRCEF4msvSkAlvjcCiRtTLLf4lgJ'
Source: Microsoft Copilot.exe.1.dr, 5fllQ7pqCcfYdIoqhx96LhArCojSoN2cBZDL1sFXjz7YVNsfr6AQfHO.cs High entropy of concatenated method names: 'GDXchcMtGDkY1Vou9LYvAwf14iS5MdkdpbYOeczPReY8DRo4whLLs4y', 'EYJGL5lDkwuMliNjoq1drYzBaEX6rBXK2AKkp1mKAHboqJEoRIa4ld5', '_61ox06DpfX2PtLLtLZzpiT9L7GUWRrZLjFXndBbotM9sdgtutjYGRSg', '_4AwNxYSdSHwFOJMbp9fy4pR9YV13ciXZ76LFLH7AIHejgj2H2OEJAEj', 'VdHhYqYEYuzQvBx4H2YKkXnCMrhi2SX8Jc1S6QLyMRjCULAqucmJK7l', '_0Q57a8G3DXcwQfFS8pyBEfRDXGzjtG3LKO1hHqFvI1iPDG6AmToNpFJ', '_7lalOXRRoj63ahdWX3HMjGmtgwxBxYVhCygMId9KeaadrHjqjEO47Tv', 'l1nBJcwnAVgjhfQsEq3MZY8KqYmowdcWxtNiCs1zkIJ8sGXDuPjIcFI', 'vN6EVCZnq0d4fHLuBG2ejJ9ZgAgLRHyN2zwTQoc4YFhbCG0zuMpQpmm', '_4Vfu30y4aMEocc6AvnJMiwhbA8gAx2wkvftBh9hihRSNdGz7pSkchEF'
Source: Microsoft Copilot.exe.1.dr, FWvSy0HBt4L93w3YhvBwnaO76cDKBGuvijgxucfviKwytM1yzRimwLs.cs High entropy of concatenated method names: 'Y2DzlIIVnJSnFRdxYcpmN2ErHj5Ro34Q954TsQwyda699iagsRoKgcw', 'NoJPZsRyXlX4VLHYh6JKql3rYNCh4dcK0igxeyblFJXKVr4bniJgodk', 'VJT1HOu7wvydw6VkH0CCNuFbH6L7K8pX0mGF0frZocx11ArWTiToztd', 'EkSCZMVSQnV6DlScrtHGpsvzngeX6YP6blSBEwpkoj8trokbaSU9O3h', 'QNfHtEVuQ2ymP7yzBI4G7ISPtk1vO5fsfzZ82PmDWhlvPFKUiC0ooQj', 'JM65JA1sXick4wXH48WgQlX9Xy8cDCO5Kezo3r9i71jK9BvB3yZ3TuH', 'SSuecDAkyQnK8PFW383yc3vHl9I9HgBMVxikYudDcV0aOWEWSZZdn1O', 'zpIAK1K0RwzI9fu6ymxXTfFi3X5U5e2tgEWXq32bWGIrHso89fFraAI', 'kswgLpNWEa3rrMjudOXStJTf51pJCbLs29f6tVgpPb8ovOzUOm86BE6', '_0pgx9BtiL5nLEsgywMnjeOuDJb6kgzcIFFOq8fZRSSsGcW2EFahEORW'
Source: Microsoft Copilot.exe.1.dr, ZIYiiDVMhvKOYrmxRtunl07Jm5X3i5kgpICkSenNgNtMVbi5BeEvi7p.cs High entropy of concatenated method names: 'Rh8IOcOZivZ3DrlDLmNIwCsyYHXpIeYkJhJO1QVhNY3tBqg35b7x34B', 'AfdAljf2buztXsx1XiGKdNAkJrgVMTtp4EMR7uAICpcT7nqCTgca8Q8', 'P9V1Ih5rsAV6a1nikxPqNtY9N6jkVXkxW2lPdGgMUdo9lhZRTY7mv1e', 'X25xugaawcC4cTH5I1fWPQz6gzGAMTTZlljlbLrfJcK3v5xG43QKyAj', 'vCV9er41lqc62F3nmnXBywE6aS6SzVQsNadyDnd255XSX4mKLXMaZbQ', '_5vnlwydEsVRKyeSdp46qUI0eDqNoN7NhUxiDX3PqrbSpcLlMwpabjbs', 'GNwINVOMISs71IP8DwssQ1lzeFEWC0LgvzZW4pJVXY085y5qgifsg4g', 'CYfCJqeUrdpt3RyziTjTuvaSiYtTfg85SteeWEhugvkzM6Xsi0PFoB6', 'RQlnXojfaB4AsdGp9fzX0ndZXQBPQqzLVIUn2E9c9c07G9oB3bgcutU', 'pEFfV4LXwLhAXpxsm8ir9L6nGZMyVsn6bBI20ZoBv6xjA1f7iRdtLnF'
Source: Microsoft Copilot.exe.1.dr, B3zcabB7XoB8QXLIvPnRn2YDu9xmAE9D74ryQl5aeoExBKaOuDeqEaBwEUZtkehlmkcYuEcSIVcgJyj66csaO6q.cs High entropy of concatenated method names: 'wd76gDubxesDbDajQMUcaXkr9pTksJZPBeuflwgSj1MDa2IQvyGjDdSv9ADZ9B6CweGvSTGSShuu5dM4QBeWG9I', 'fNgi7pPBcbsQy9237UndotP16XTPTisnfZZg8aORcJcVHgGDn3t2tW0NOXUa7UXoaHcBEpllHsp7kTiQldFbkJ7', '_7Eq7iOmpU53TTL8OHOAqqdBQz0o3ZyZ3waB5TJ00Uwgl2rc0DeB567MejLOKt9RKQOZnRy7WQ9dDLkrc7kn9Yi9', '_56N8isy8FI1GuJBl0z4C97Exkx9DmPTVhg08FgBnwD2UwJbcT7SIERrN04Ay9U8ARzDTgLxkvHNmDbQF0rCZTGM', '_5rDOO4kboCqyZPyzA2OaLmSQ3MR3CPrXR8kf87WFNwYW1IwjTSowvn26IhLEWcE9buxmmXZqQTVhySOcv1B7qr0', 'MsXc94LEFTYocjklQThny61epluqEyxDUubulPuO0jqRBLShKfjA07v3t6tOfFdmr1MyE3Dx9IhhIiJknVhUQqi', 'RXscBl8tsb4J5B3Hg3HuxHnUrbAItIsyvMVhufxjaU3xmx27h7rA5jB2azQBHcPnq6oXkQWD16BD7wLJyROp5jY', 'iegOmGxTPr28aBjTs1Bpt3gyCSgOA4ldBKs7MHbHTO59fBv6Bk2AgdwazLH2SdZfvgmu3ESMfXjVxFaaiaIP6rJ', '_9SJCwAwqP1bNJ1lxmTucjMgUJ3uVv0E3ADEgYVmlr3OYlPEH5JwxrK44d4eE3Be8DlbiVFOYB2WjaV9KRFiYlGD', '_5dLEcawLxZeFVKZjgpN3wzdhbKaPtDhQOFKyHjPR9MIFsyMgVpijXc15Wr8KIJUPqhdIITTsfWDOeicEZlxZK9o'
Source: Microsoft Copilot.exe.1.dr, lN9yj0DclvLFRThUfMYKKmx2hzrhxQ13n5kxy2uTP7z60LyMXNHr5aH2jqOLeRa4Pi9le3w24R6tmLaZf8rxnyC.cs High entropy of concatenated method names: 'asG8aK4379S4LVCWeww50ZK1vccCwVCRHCQgD4Ttkcesi7hM1iBGOi0w6QJhyvNQTnOKDpqVArBx7i0J7VfZagn', 'RBotrOTrFq2SH6MOLHscsFYm1gIiFwiw49RstOzq9T2M5c8XngG9XGaDNlMOYiCh9YF8wPXEieU6ro9JXJoZGGd', 'LLvNWppYJwppCewCURVUIOv256OxJFlObOUrrbVbxQ9Jzk9Ud2Dn6sktBMc60ueRNkvbqrgZpCyznX9WES6LIDB', '_1D8H93VJcm5uLul3rV4GmDH5kBITjCt1W72fXJCWAx2mtqvEnbz2GMHGEXmUANIRcamcCVxw9bDxnN5Hn46jKWI', 'GJQCgPL0mJRNm3M', '_4MZQxFDozqVQOs0', 'dFghmN08kbr7QtI', 'wgsKqYmdAb5ZZQI', 't8GUAUDDrhNkhmv', '_2rtGFiKXxe6wvJV'
Source: Microsoft Copilot.exe.1.dr, 08I4HlpfZvcXgQJn6jhwLOiX5NhqxmSDMQTziisZ5tgE8NeYxznxnl0.cs High entropy of concatenated method names: 'rkhiNPWgaENIbdkCp6mJtdOPN3mFbpQMuPwvi8kf4rGCc2X72CpsDNt', '_59bJb29T3A9eh4GP7lPhvEZDx5CXQKRkNqgJsPN3vWk8rPr3YsWN6q1FQAdkmo7JVizqwY4Bc0hhMF873KwYNxE', '_8SpLtqtxL11qXpFPX0EYNetLlM7tGh5fkVJXBWlIBPqVCCMlqqoEtdyIYiSROIRSFJUCYVze3U7GOgybQJ1GZ4B', '_3tN4sqb7XBF96eyGZbHxv1TWxurThY4vI02UIVrImdNI7ZZ3yxAw34w8MHNp44J9sS1m4qNtxWtJc6cGBgvt2ym', 'UQBh4otD5J4nlDsaVWOkC8ul68K27zQk7FVjcst0hAxOyvXHJZp1hgwAhyK8oAigDYhN5Oc9gu453aovpq1m3EQ', 'lBAkOyFN4esJnd6690p9qvYki7ULS5jkmRPFPFIvZmlkhOv8jdfX7MiLJ4mM2T8AZutZSoxVZ2GtseegPiFKjHL', 'VRPg9HqyC1arRrsr8BoK5OUv9X8pjpUTh10SPJW4GIotpLazNtgLvv04K5DmXcqBXsNNIEcxbeu9H9ZtQzd1hcm', 'ha4EUhVu1mLLH2coeWSfQZrhSfxZJDXOgv2uauPZ6fPKI8yxvygvQVk3CvudwZqQ3Wg3j4guhUTHn1zs5k0Zm9R', 'MwHHezqwVMSNQjjljHaBml7A5yY2DrmHdQCYBX3eVMwOucmz2b2z4FzLzRNtREPUp3VezMRw9HXbwmuBye73QsF', 'RWB6kPdfXI6U1deoBZhLKOdv6VCsya4A9FnQidDywAh6d3DP70QkSqvixLFsG9Yrhns4n3ni5x4aKFRew2wA1Yq'
Source: Microsoft Copilot.exe.1.dr, o1PUaP6qj5vEhIVxGUaUdQDcJ68N7eDS7RtJXgQQQQD6rKQdDpNHgsbQgjpqmJNSRQZ6VoSP6jCdrk7Id0L2ih4.cs High entropy of concatenated method names: 'bJcJPCY3g4GZB37VXKjWdykXzvKaVcspg6h2Tky5txjBt3vo0IpVM4fOzFGUuvQU0wOVdHT3roVP9VhbXJ8GP5W', 'qbixFGD30WX2pBs', 'YdqRMxdvksPO6bu', 'vafmKXXYFmdgUGo', '_32tQUhdDBDxEIwM'
Drops PE files
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Quasar.Common.Tests.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.TestPlatform.AdapterUtilities.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.VisualStudio.CodeCoverage.Shim.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\BouncyCastle.Crypto.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mech Server.exe Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.VisualStudio.TestPlatform.MSTest.TestAdapter.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\protobuf-net.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.VisualStudio.TestPlatform.TestFramework.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Rocks.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Vestris.ResourceLib.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\aa-DJ\Quasar.resources.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Pdb.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Open.Nat.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Mdb.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.Interface.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Gma.System.MouseKeyHook.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Guna.UI2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe File created: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Quasar.Common.dll Jump to dropped file
Source: C:\Users\user\Desktop\PixpFUv4G7.exe File created: C:\Users\user\AppData\Local\Temp\Copilot.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft Copilot" /tr "C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe"
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Copilot.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Copilot.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Copilot Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Copilot Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Check if machine is in data center or colocation facility
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: PixpFUv4G7.exe, 00000000.00000002.1258939733.0000000002820000.00000004.00000020.00020000.00000000.sdmp, Copilot.exe, 00000001.00000002.2504673520.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, Copilot.exe, 00000001.00000000.1250594519.0000000000962000.00000002.00000001.01000000.00000005.sdmp, Microsoft Copilot.exe.1.dr Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Memory allocated: 2A60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Memory allocated: 1ABB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Memory allocated: D90000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Memory allocated: 2A00000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Memory allocated: 4A00000 memory commit | memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Memory allocated: 1660000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Memory allocated: 1B1B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Memory allocated: 1110000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Memory allocated: 1AC30000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Memory allocated: CA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Memory allocated: 1A910000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Memory allocated: EB0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Memory allocated: 1A7F0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Window / User API: threadDelayed 9590 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5975 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3773 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7699 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1891 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7700
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1900
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2598
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6951
Found dropped PE file which has not been started or loaded
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Pdb.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Quasar.Common.Tests.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.TestPlatform.AdapterUtilities.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Open.Nat.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.VisualStudio.CodeCoverage.Shim.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Mdb.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\BouncyCastle.Crypto.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mech Server.exe Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.VisualStudio.TestPlatform.MSTest.TestAdapter.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\protobuf-net.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.Interface.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Gma.System.MouseKeyHook.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Microsoft.VisualStudio.TestPlatform.TestFramework.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Guna.UI2.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.Rocks.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mono.Cecil.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Quasar.Common.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Vestris.ResourceLib.dll Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\aa-DJ\Quasar.resources.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe TID: 576 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6012 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7608 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860 Thread sleep count: 7699 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7856 Thread sleep count: 1891 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8148 Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3452 Thread sleep count: 2598 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3284 Thread sleep count: 6951 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5256 Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe TID: 6836 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe TID: 2168 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe TID: 4260 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe TID: 6120 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\unarchiver.exe Code function: 3_2_00CFB286 GetSystemInfo, 3_2_00CFB286
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Thread delayed: delay time: 922337203685477
Source: Microsoft Copilot.exe.1.dr Binary or memory string: vmware
Source: PixpFUv4G7.exe, 00000000.00000002.1257409990.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: PixpFUv4G7.exe, 00000000.00000002.1257409990.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Copilot.exe, 00000001.00000002.2513107629.000000001BA78000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Code function: 1_2_00007FFAACB3764A CheckRemoteDebuggerPresent, 1_2_00007FFAACB3764A
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process queried: DebugPort Jump to behavior
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Code function: 0_2_00401475 EntryPoint,memset,SetUnhandledExceptionFilter,__set_app_type,_controlfp,__argc,__argv,_environ,_environ,__argv,__getmainargs,__argc,__argv,_environ,__argc,__argc,exit, 0_2_00401475
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\Copilot.exe'
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe'
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\Copilot.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe' Jump to behavior
Bypasses PowerShell execution policy
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\Copilot.exe'
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Process created: C:\Users\user\AppData\Local\Temp\Copilot.exe "C:\Users\user~1\AppData\Local\Temp\Copilot.exe" Jump to behavior
Source: C:\Users\user\Desktop\PixpFUv4G7.exe Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user~1\AppData\Local\Temp\Mech RAT.zip" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\Copilot.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Copilot.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft Copilot.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft Copilot" /tr "C:\Users\user~1\AppData\Local\Temp\Microsoft Copilot.exe" Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd" "C:\Users\user~1\AppData\Local\Temp\Mech RAT.zip" Jump to behavior
Source: Copilot.exe, 00000001.00000002.2504673520.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Copilot.exe, 00000001.00000002.2504673520.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: Copilot.exe, 00000001.00000002.2504673520.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Copilot.exe, 00000001.00000002.2504673520.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: Copilot.exe, 00000001.00000002.2504673520.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Copilot.exe, 00000001.00000002.2504673520.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: Copilot.exe, 00000001.00000002.2504673520.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Copilot.exe, 00000001.00000002.2504673520.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0@
Source: Copilot.exe, 00000001.00000002.2504673520.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Copilot.exe, 00000001.00000002.2504673520.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager2
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Copilot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Copilot.exe, 00000001.00000002.2513107629.000000001BB36000.00000004.00000020.00020000.00000000.sdmp, Copilot.exe, 00000001.00000002.2498539395.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp, Copilot.exe, 00000001.00000002.2513107629.000000001BA78000.00000004.00000020.00020000.00000000.sdmp, Copilot.exe, 00000001.00000002.2498539395.0000000000E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\Copilot.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected Quasar RAT
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Quasar.Common.dll, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Profiles\Default.xml, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mech Server.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin, type: DROPPED
Yara detected XWorm
Source: Yara match File source: 1.0.Copilot.exe.960000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1258939733.0000000002820000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2504673520.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.1250594519.0000000000962000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PixpFUv4G7.exe PID: 344, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Copilot.exe PID: 6488, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\Copilot.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe, type: DROPPED

Remote Access Functionality
barindex
Yara detected Quasar RAT
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Quasar.Common.dll, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Profiles\Default.xml, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\Mech Server.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\dpt5uaov.zyd\Mech RAT\client.bin, type: DROPPED
Yara detected XWorm
Source: Yara match File source: 1.0.Copilot.exe.960000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1258939733.0000000002820000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2504673520.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.1250594519.0000000000962000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PixpFUv4G7.exe PID: 344, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Copilot.exe PID: 6488, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\Copilot.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\Microsoft Copilot.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1527486 Sample: PixpFUv4G7.exe Startdate: 07/10/2024 Architecture: WINDOWS Score: 100 62 ip-api.com 2->62 64 content-portion.gl.at.ply.gg 2->64 70 Suricata IDS alerts for network traffic 2->70 72 Found malware configuration 2->72 74 Malicious sample detected (through community Yara rule) 2->74 76 19 other signatures 2->76 9 PixpFUv4G7.exe 3 3 2->9         started        13 Microsoft Copilot.exe 2->13         started        15 Microsoft Copilot.exe 2->15         started        17 2 other processes 2->17 signatures3 process4 file5 52 C:\Users\user\AppData\Local\...\Copilot.exe, PE32 9->52 dropped 86 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 9->86 19 unarchiver.exe 4 9->19         started        21 Copilot.exe 15 6 9->21         started        signatures6 process7 dnsIp8 26 7za.exe 59 19->26         started        66 ip-api.com 208.95.112.1, 49699, 80 TUT-ASUS United States 21->66 68 content-portion.gl.at.ply.gg 147.185.221.21, 47900, 49971, 49973 SALSGIVERUS United States 21->68 50 C:\Users\user\...\Microsoft Copilot.exe, PE32 21->50 dropped 78 Antivirus detection for dropped file 21->78 80 Multi AV Scanner detection for dropped file 21->80 82 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->82 84 6 other signatures 21->84 29 powershell.exe 23 21->29         started        32 powershell.exe 23 21->32         started        34 powershell.exe 21->34         started        36 2 other processes 21->36 file9 signatures10 process11 file12 54 C:\Users\user\AppData\...\protobuf-net.dll, PE32 26->54 dropped 56 C:\Users\user\AppData\Local\...\client.bin, PE32 26->56 dropped 58 C:\Users\user\...\Quasar.resources.dll, PE32 26->58 dropped 60 20 other files (19 malicious) 26->60 dropped 38 conhost.exe 26->38         started        88 Loading BitLocker PowerShell Module 29->88 40 conhost.exe 29->40         started        42 conhost.exe 32->42         started        44 conhost.exe 34->44         started        46 conhost.exe 36->46         started        48 conhost.exe 36->48         started        signatures13 process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS true
147.185.221.21
 content-portion.gl.at.ply.gg United States
12087 SALSGIVERUS true

Contacted Domains

Name IP Active
content-portion.gl.at.ply.gg 147.185.221.21 true
ip-api.com 208.95.112.1 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
content-portion.gl.at.ply.gg true
    		unknown
    http://ip-api.com/line/?fields=hosting false
    • URL Reputation: safe
    		 unknown