Windows Analysis Report
jcMcDQ11pZ.exe

Overview

General Information

Sample name: jcMcDQ11pZ.exe
renamed because original name is a hash value
Original sample name: cc92146cb6e5e514c4bae54ced9f4bf6724b6b8b370f2f6d219aa5b0f95390ba.exe
Analysis ID: 1532622
MD5: d68dba883125d1a3408e13b84a3524e1
SHA1: b613717517240829d8c28242a3b2ec7c6576b3f3
SHA256: cc92146cb6e5e514c4bae54ced9f4bf6724b6b8b370f2f6d219aa5b0f95390ba
Tags: exeuser-Chainskilabs
Infos:

Detection

AsyncRAT, XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AsyncRAT
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Protects its processes via BreakOnTermination flag
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Powershell Defender Exclusion
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
AsyncRAT AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
Name Description Attribution Blogpost URLs Link
XWorm Malware with wide range of capabilities ranging from RAT to ransomware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: jcMcDQ11pZ.exe Avira: detected
Antivirus detection for dropped file
Source: C:\ProgramData\AdobeIPC Avira: detection malicious, Label: TR/Spy.Gen
Source: C:\ProgramData\AdobeIPC.exe Avira: detection malicious, Label: TR/Spy.Gen
Found malware configuration
Source: 00000000.00000002.1714234137.0000000002A01000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": "https://pastebin.com/raw/LsuynkUz", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\AdobeIPC ReversingLabs: Detection: 87%
Source: C:\ProgramData\AdobeIPC Virustotal: Detection: 65% Perma Link
Source: C:\ProgramData\AdobeIPC.exe ReversingLabs: Detection: 87%
Source: C:\ProgramData\AdobeIPC.exe Virustotal: Detection: 65% Perma Link
Source: C:\ProgramData\Stellar Generator.exe ReversingLabs: Detection: 54%
Source: C:\ProgramData\Stellar Generator.exe Virustotal: Detection: 34% Perma Link
Multi AV Scanner detection for submitted file
Source: jcMcDQ11pZ.exe ReversingLabs: Detection: 71%
Source: jcMcDQ11pZ.exe Virustotal: Detection: 75% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\ProgramData\AdobeIPC Joe Sandbox ML: detected
Source: C:\ProgramData\AdobeIPC.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: jcMcDQ11pZ.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.raw.unpack String decryptor: https://pastebin.com/raw/LsuynkUz
Source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.raw.unpack String decryptor: <123456789>
Source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.raw.unpack String decryptor: <Xwormmm>
Source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.raw.unpack String decryptor: Stellar
Source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.raw.unpack String decryptor: USB.exe
Source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.raw.unpack String decryptor: %ProgramData%
Source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.raw.unpack String decryptor: AdobeIPC
Uses 32bit PE files
Source: jcMcDQ11pZ.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: jcMcDQ11pZ.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: $C:\ProgramData\Stellar Generator.pdb source: jcMcDQ11pZ.exe, 00000000.00000002.1714234137.0000000002A01000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: D:\tools\programmes\Rain Generator\Rain Generator\obj\Release\Rain Generator.pdb source: Stellar Generator.exe, 00000001.00000000.1709947841.000000000095D000.00000002.00000001.01000000.00000006.sdmp, Stellar Generator.exe.0.dr
Source: Binary string: D:\tools\programmes\Rain Generator\Rain Generator\obj\Release\Rain Generator.pdbE source: Stellar Generator.exe, 00000001.00000000.1709947841.000000000095D000.00000002.00000001.01000000.00000006.sdmp, Stellar Generator.exe.0.dr
Source: Binary string: !*Stellar Generator.pdb source: jcMcDQ11pZ.exe
Source: Binary string: %Stellar Generator.pdb-=>False-=>False source: jcMcDQ11pZ.exe, 00000000.00000002.1714234137.0000000002A01000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: Stellar Generator.pdb source: jcMcDQ11pZ.exe, 00000000.00000002.1714234137.0000000002A01000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: KStellar Generator.pdb-=>False-=>False source: jcMcDQ11pZ.exe

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://pastebin.com/raw/LsuynkUz
Connects to a pastebin service (likely for C&C)
Source: unknown DNS query: name: pastebin.com
Yara detected Generic Downloader
Source: Yara match File source: C:\ProgramData\Guna.UI2.dll, type: DROPPED
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 193.161.193.99:46070
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /raw/LsuynkUz HTTP/1.1Host: pastebin.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 193.161.193.99 193.161.193.99
Source: Joe Sandbox View IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View IP Address: 172.67.19.24 172.67.19.24
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: unknown TCP traffic detected without corresponding DNS query: 193.161.193.99
Source: global traffic HTTP traffic detected: GET /raw/LsuynkUz HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: pastebin.com
Source: Guna.UI2.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Guna.UI2.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Guna.UI2.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Guna.UI2.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Guna.UI2.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Guna.UI2.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: powershell.exe, 00000004.00000002.1827533544.0000027F73003000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1920848773.00000299B4783000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2045023825.0000020C10073000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2235942487.000001E2A1071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: Guna.UI2.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: Guna.UI2.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: Guna.UI2.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 0000000E.00000002.2106648780.000001E29122B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1803790021.0000027F631B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1860426064.00000299A4939000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1965120233.0000020C00228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2106648780.000001E29122B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: AdobeIPC.exe, 00000002.00000002.2964085942.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1803790021.0000027F62F91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1860426064.00000299A4711000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1965120233.0000020C00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2106648780.000001E291001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1803790021.0000027F631B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1860426064.00000299A4939000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1965120233.0000020C00228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2106648780.000001E29122B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000000E.00000002.2106648780.000001E29122B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: powershell.exe, 00000004.00000002.1834495488.0000027F7B862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.Q
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Stellar Generator.exe, 00000001.00000002.3019731472.0000000007342000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: powershell.exe, 00000004.00000002.1803790021.0000027F62F91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1860426064.00000299A4711000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1965120233.0000020C00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2106648780.000001E291001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000E.00000002.2235942487.000001E2A1071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.2235942487.000001E2A1071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.2235942487.000001E2A1071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000E.00000002.2106648780.000001E29122B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: Stellar Generator.exe, 00000001.00000002.2967726546.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gunaframework.com/api/licensing.php
Source: Stellar Generator.exe, 00000001.00000002.2967726546.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gunaframework.com/api/licensing.phpLR
Source: Stellar Generator.exe, 00000001.00000002.2967726546.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gunaui.com/
Source: Stellar Generator.exe, 00000001.00000002.2967726546.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gunaui.com/LR
Source: Stellar Generator.exe, 00000001.00000002.2967726546.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gunaui.com/api/licensing.php
Source: Stellar Generator.exe, 00000001.00000002.2967726546.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gunaui.com/api/licensing.phpLR
Source: Stellar Generator.exe, 00000001.00000002.2967726546.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gunaui.com/pricing
Source: Stellar Generator.exe, 00000001.00000002.2967726546.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gunaui.com/pricingLR
Source: powershell.exe, 00000004.00000002.1827533544.0000027F73003000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1920848773.00000299B4783000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2045023825.0000020C10073000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2235942487.000001E2A1071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: AdobeIPC.exe, 00000002.00000002.2964085942.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pastebin.com
Source: Stellar Generator.exe, 00000001.00000000.1709947841.0000000000922000.00000002.00000001.01000000.00000006.sdmp, Stellar Generator.exe.0.dr String found in binary or memory: https://pastebin.com/raw/LSuWhARfChttps://pastebin.com/raw/j4XYdsdHChttps://paste.fo/raw/9fc49c53951
Source: AdobeIPC, 00000016.00000002.2950830442.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pastebin.com/raw/LsuynkUz
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49768 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected AsyncRAT
Source: Yara match File source: Process Memory Space: AdobeIPC.exe PID: 7364, type: MEMORYSTR

Operating System Destruction
barindex
Protects its processes via BreakOnTermination flag
Source: C:\ProgramData\AdobeIPC.exe Process information set: 01 00 00 00 Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.jcMcDQ11pZ.exe.2a341a0.2.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.jcMcDQ11pZ.exe.2a341a0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.0.AdobeIPC.exe.af0000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1714234137.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000000.1711447769.0000000000AF2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\ProgramData\AdobeIPC, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\ProgramData\AdobeIPC.exe, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Detected potential crypto function
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0142D4FC 1_2_0142D4FC
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_05286D38 1_2_05286D38
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0528A820 1_2_0528A820
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_05287260 1_2_05287260
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_05280007 1_2_05280007
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0528A069 1_2_0528A069
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0528A078 1_2_0528A078
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_05280040 1_2_05280040
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0528A810 1_2_0528A810
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0528CB6F 1_2_0528CB6F
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0528CB99 1_2_0528CB99
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0528D628 1_2_0528D628
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_05287250 1_2_05287250
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_05849194 1_2_05849194
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_05843CC0 1_2_05843CC0
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_05843CD0 1_2_05843CD0
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_05845750 1_2_05845750
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_05844688 1_2_05844688
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0584BE60 1_2_0584BE60
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0584467B 1_2_0584467B
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0584494B 1_2_0584494B
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_05843BE4 1_2_05843BE4
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_072EF149 1_2_072EF149
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_072E28F0 1_2_072E28F0
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_072E276C 1_2_072E276C
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_072E27AC 1_2_072E27AC
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_072E33F0 1_2_072E33F0
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_072EA2A9 1_2_072EA2A9
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_072E3069 1_2_072E3069
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_072EB070 1_2_072EB070
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_072E3EE2 1_2_072E3EE2
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_072E3C1C 1_2_072E3C1C
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_072E3C4C 1_2_072E3C4C
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07941FB8 1_2_07941FB8
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07943514 1_2_07943514
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07946320 1_2_07946320
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0794669A 1_2_0794669A
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0794668D 1_2_0794668D
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_079466FB 1_2_079466FB
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07946610 1_2_07946610
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07946620 1_2_07946620
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07946676 1_2_07946676
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07946310 1_2_07946310
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07949A00 1_2_07949A00
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_079499F0 1_2_079499F0
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0794689B 1_2_0794689B
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0794F000 1_2_0794F000
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_079636E0 1_2_079636E0
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_079606E8 1_2_079606E8
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07965610 1_2_07965610
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07968B91 1_2_07968B91
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07968BB0 1_2_07968BB0
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07966FC0 1_2_07966FC0
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07966F6E 1_2_07966F6E
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_079606D7 1_2_079606D7
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_079636D0 1_2_079636D0
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07965600 1_2_07965600
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_079658D0 1_2_079658D0
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_079658C2 1_2_079658C2
Source: C:\ProgramData\AdobeIPC.exe Code function: 2_2_00007FFD9B7F16A9 2_2_00007FFD9B7F16A9
Source: C:\ProgramData\AdobeIPC.exe Code function: 2_2_00007FFD9B7F20CD 2_2_00007FFD9B7F20CD
Source: C:\ProgramData\AdobeIPC Code function: 18_2_00007FFD9B7F0EFA 18_2_00007FFD9B7F0EFA
Source: C:\ProgramData\AdobeIPC Code function: 18_2_00007FFD9B7F16A9 18_2_00007FFD9B7F16A9
Source: C:\ProgramData\AdobeIPC Code function: 18_2_00007FFD9B7F20CD 18_2_00007FFD9B7F20CD
Source: C:\ProgramData\AdobeIPC.exe Code function: 19_2_00007FFD9B7F0EFA 19_2_00007FFD9B7F0EFA
Source: C:\ProgramData\AdobeIPC.exe Code function: 19_2_00007FFD9B7F16A9 19_2_00007FFD9B7F16A9
Source: C:\ProgramData\AdobeIPC.exe Code function: 19_2_00007FFD9B7F20CD 19_2_00007FFD9B7F20CD
Source: C:\ProgramData\AdobeIPC.exe Code function: 20_2_00007FFD9B7E0EFA 20_2_00007FFD9B7E0EFA
Source: C:\ProgramData\AdobeIPC.exe Code function: 20_2_00007FFD9B7E16A9 20_2_00007FFD9B7E16A9
Source: C:\ProgramData\AdobeIPC.exe Code function: 20_2_00007FFD9B7E20CD 20_2_00007FFD9B7E20CD
Source: C:\ProgramData\AdobeIPC Code function: 22_2_00007FFD9B800EFA 22_2_00007FFD9B800EFA
Source: C:\ProgramData\AdobeIPC Code function: 22_2_00007FFD9B8016A9 22_2_00007FFD9B8016A9
Source: C:\ProgramData\AdobeIPC Code function: 22_2_00007FFD9B8020CD 22_2_00007FFD9B8020CD
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\Guna.UI2.dll E658E8A5616245DBE655E194B59F1BB704AAEAFBD0925D6EEBBE70555A638CDD
Sample file is different than original file name gathered from version info
Source: jcMcDQ11pZ.exe, 00000000.00000002.1714234137.0000000002A01000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAdobeIPC.exe4 vs jcMcDQ11pZ.exe
Source: jcMcDQ11pZ.exe, 00000000.00000000.1704032480.00000000005DC000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameStellar.exe4 vs jcMcDQ11pZ.exe
Source: jcMcDQ11pZ.exe Binary or memory string: OriginalFilenameStellar.exe4 vs jcMcDQ11pZ.exe
Uses 32bit PE files
Source: jcMcDQ11pZ.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.jcMcDQ11pZ.exe.2a341a0.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.jcMcDQ11pZ.exe.2a341a0.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.0.AdobeIPC.exe.af0000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1714234137.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000000.1711447769.0000000000AF2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\ProgramData\AdobeIPC, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\ProgramData\AdobeIPC.exe, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: jcMcDQ11pZ.exe, XxrMCzRlJKexMiGJO0rQe5.cs Cryptographic APIs: 'TransformFinalBlock'
Source: AdobeIPC.exe.0.dr, S8DvIln0iFJezbO2WvcZETMABEMYqaUNREr4HfdaFNpje6DXBKySAAJrQ4ni2qmNtnfSmwL.cs Cryptographic APIs: 'TransformFinalBlock'
Source: AdobeIPC.exe.0.dr, sdBBZUb8ihBfnvhHYXYv16FS7igqRtC1qMic9XBri8Xj2XQeIftSlA4GdJKPeIR60HkdmwU.cs Cryptographic APIs: 'TransformFinalBlock'
Source: AdobeIPC.exe.0.dr, sdBBZUb8ihBfnvhHYXYv16FS7igqRtC1qMic9XBri8Xj2XQeIftSlA4GdJKPeIR60HkdmwU.cs Cryptographic APIs: 'TransformFinalBlock'
Source: classification engine Classification label: mal100.troj.evad.winEXE@24/28@1/2
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\jcMcDQ11pZ.exe.log Jump to behavior
Source: C:\ProgramData\AdobeIPC Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03
Source: C:\ProgramData\AdobeIPC.exe Mutant created: \Sessions\1\BaseNamedObjects\X3pgFbVKpY4LNwye
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Mutant created: \Sessions\1\BaseNamedObjects\r9yVyTgJ5HiGuC4ZO
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4464:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3732:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7868:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03
Source: C:\ProgramData\AdobeIPC.exe File created: C:\Users\user\AppData\Local\Temp\Log.tmp Jump to behavior
Source: jcMcDQ11pZ.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: jcMcDQ11pZ.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: jcMcDQ11pZ.exe ReversingLabs: Detection: 71%
Source: jcMcDQ11pZ.exe Virustotal: Detection: 75%
Source: Stellar Generator.exe String found in binary or memory: !--StartFragment-->
Source: unknown Process created: C:\Users\user\Desktop\jcMcDQ11pZ.exe "C:\Users\user\Desktop\jcMcDQ11pZ.exe"
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process created: C:\ProgramData\Stellar Generator.exe "C:\ProgramData\Stellar Generator.exe"
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process created: C:\ProgramData\AdobeIPC.exe "C:\ProgramData\AdobeIPC.exe"
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AdobeIPC.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AdobeIPC'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AdobeIPC" /tr "C:\ProgramData\AdobeIPC"
Source: C:\Windows\System32\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\ProgramData\AdobeIPC C:\ProgramData\AdobeIPC
Source: unknown Process created: C:\ProgramData\AdobeIPC.exe "C:\ProgramData\AdobeIPC.exe"
Source: unknown Process created: C:\ProgramData\AdobeIPC.exe "C:\ProgramData\AdobeIPC.exe"
Source: unknown Process created: C:\ProgramData\AdobeIPC C:\ProgramData\AdobeIPC
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process created: C:\ProgramData\Stellar Generator.exe "C:\ProgramData\Stellar Generator.exe" Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process created: C:\ProgramData\AdobeIPC.exe "C:\ProgramData\AdobeIPC.exe" Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC.exe' Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AdobeIPC.exe' Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC' Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AdobeIPC' Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AdobeIPC" /tr "C:\ProgramData\AdobeIPC" Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: wldp.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: profapi.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: wldp.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: propsys.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: edputil.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: slc.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: sppc.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: sxs.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: mpr.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: rasman.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: secur32.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: schannel.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: amsi.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\ProgramData\AdobeIPC Section loaded: mscoree.dll
Source: C:\ProgramData\AdobeIPC Section loaded: apphelp.dll
Source: C:\ProgramData\AdobeIPC Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AdobeIPC Section loaded: version.dll
Source: C:\ProgramData\AdobeIPC Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\AdobeIPC Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AdobeIPC Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AdobeIPC Section loaded: uxtheme.dll
Source: C:\ProgramData\AdobeIPC Section loaded: sspicli.dll
Source: C:\ProgramData\AdobeIPC Section loaded: cryptsp.dll
Source: C:\ProgramData\AdobeIPC Section loaded: rsaenh.dll
Source: C:\ProgramData\AdobeIPC Section loaded: cryptbase.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: mscoree.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: version.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: sspicli.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: mscoree.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: version.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: sspicli.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\AdobeIPC.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\AdobeIPC Section loaded: mscoree.dll
Source: C:\ProgramData\AdobeIPC Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AdobeIPC Section loaded: version.dll
Source: C:\ProgramData\AdobeIPC Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\AdobeIPC Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AdobeIPC Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AdobeIPC Section loaded: uxtheme.dll
Source: C:\ProgramData\AdobeIPC Section loaded: sspicli.dll
Source: C:\ProgramData\AdobeIPC Section loaded: cryptsp.dll
Source: C:\ProgramData\AdobeIPC Section loaded: rsaenh.dll
Source: C:\ProgramData\AdobeIPC Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: jcMcDQ11pZ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: jcMcDQ11pZ.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: jcMcDQ11pZ.exe Static file information: File size 2523648 > 1048576
Source: jcMcDQ11pZ.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x267800
Source: jcMcDQ11pZ.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: $C:\ProgramData\Stellar Generator.pdb source: jcMcDQ11pZ.exe, 00000000.00000002.1714234137.0000000002A01000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: D:\tools\programmes\Rain Generator\Rain Generator\obj\Release\Rain Generator.pdb source: Stellar Generator.exe, 00000001.00000000.1709947841.000000000095D000.00000002.00000001.01000000.00000006.sdmp, Stellar Generator.exe.0.dr
Source: Binary string: D:\tools\programmes\Rain Generator\Rain Generator\obj\Release\Rain Generator.pdbE source: Stellar Generator.exe, 00000001.00000000.1709947841.000000000095D000.00000002.00000001.01000000.00000006.sdmp, Stellar Generator.exe.0.dr
Source: Binary string: !*Stellar Generator.pdb source: jcMcDQ11pZ.exe
Source: Binary string: %Stellar Generator.pdb-=>False-=>False source: jcMcDQ11pZ.exe, 00000000.00000002.1714234137.0000000002A01000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: Stellar Generator.pdb source: jcMcDQ11pZ.exe, 00000000.00000002.1714234137.0000000002A01000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: KStellar Generator.pdb-=>False-=>False source: jcMcDQ11pZ.exe

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: AdobeIPC.exe.0.dr, xLyqGwpuVDngJAR7ygvkm4XBFmOD1AHQAzvvxcZvj74RpeGAGy2N2z.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{TnXZ5NelSsKd2h2GfmCdLRn0EReRV0AYj2GfUoWaK80iRmtllcx9SI.LYv9fWNMOk4Zu1sEu98BXyzMEyOQPK20zo2P811ZyE48mCQ6caU9gU,TnXZ5NelSsKd2h2GfmCdLRn0EReRV0AYj2GfUoWaK80iRmtllcx9SI.wpafowHFmQbRjiDysG2RmvTtazFdImpvBUxQxgQTKa4wKbjZcYFNpc,TnXZ5NelSsKd2h2GfmCdLRn0EReRV0AYj2GfUoWaK80iRmtllcx9SI.vDxt50gkIWPGNW1VelrsDyNmFAOBuPJn90b34F5UxGKLjAsxdKtnLK,TnXZ5NelSsKd2h2GfmCdLRn0EReRV0AYj2GfUoWaK80iRmtllcx9SI._6hdNyQApRqcFBPAksUU131ybwiuNU5xoaMQSR9GZii3orBCjnkke8W,sdBBZUb8ihBfnvhHYXYv16FS7igqRtC1qMic9XBri8Xj2XQeIftSlA4GdJKPeIR60HkdmwU.L8IuGIPy3wASjACRUHT49VDgT5cWmCTUMQapkvyVUvQtCAmoHsOL4leWR8qzr0kq8rf8n3i()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: AdobeIPC.exe.0.dr, xLyqGwpuVDngJAR7ygvkm4XBFmOD1AHQAzvvxcZvj74RpeGAGy2N2z.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{q34wYNeY0pZUJD3Mz74fafasgx4lA9aDzkc2EoCwq47j6qKNT3rh3B0Hb89U13QNiAlqWsxGfx3CvYDzBJNDAI[2],sdBBZUb8ihBfnvhHYXYv16FS7igqRtC1qMic9XBri8Xj2XQeIftSlA4GdJKPeIR60HkdmwU.MvFcKpNjFNAXOu0WDHejWLBfKJWpw58Rz3pYDS8yY2OKITW8TQkfCnlHqhFfWRBehxprTNo(Convert.FromBase64String(q34wYNeY0pZUJD3Mz74fafasgx4lA9aDzkc2EoCwq47j6qKNT3rh3B0Hb89U13QNiAlqWsxGfx3CvYDzBJNDAI[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: AdobeIPC.exe.0.dr, xLyqGwpuVDngJAR7ygvkm4XBFmOD1AHQAzvvxcZvj74RpeGAGy2N2z.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { q34wYNeY0pZUJD3Mz74fafasgx4lA9aDzkc2EoCwq47j6qKNT3rh3B0Hb89U13QNiAlqWsxGfx3CvYDzBJNDAI[2] }}, (string[])null, (Type[])null, (bool[])null, true)
.NET source code contains potential unpacker
Source: AdobeIPC.exe.0.dr, xLyqGwpuVDngJAR7ygvkm4XBFmOD1AHQAzvvxcZvj74RpeGAGy2N2z.cs .Net Code: _4P3eA3JVndfRDnBYwCPShXM1xEYCV8pFB2lx6tDnPhBqMFpjYP0LIW System.AppDomain.Load(byte[])
Source: AdobeIPC.exe.0.dr, xLyqGwpuVDngJAR7ygvkm4XBFmOD1AHQAzvvxcZvj74RpeGAGy2N2z.cs .Net Code: Lr3XX43sVBdkvQZryDXVC3CrOcoJkYzptf9kIvB5J8VFQ55VMRuVjdAqagWfoT8F77eOvuyPhPUXKIH6Rk2PQe System.AppDomain.Load(byte[])
Source: AdobeIPC.exe.0.dr, xLyqGwpuVDngJAR7ygvkm4XBFmOD1AHQAzvvxcZvj74RpeGAGy2N2z.cs .Net Code: Lr3XX43sVBdkvQZryDXVC3CrOcoJkYzptf9kIvB5J8VFQ55VMRuVjdAqagWfoT8F77eOvuyPhPUXKIH6Rk2PQe
Binary contains a suspicious time stamp
Source: Stellar Generator.exe.0.dr Static PE information: 0xA80A0C31 [Sat May 3 23:39:29 2059 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Code function: 0_2_00007FFD9B7D00AD pushad ; iretd 0_2_00007FFD9B7D00C1
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0528D1F3 push 9B0528CFh; iretd 1_2_0528D1FD
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07945604 push 8BFFFFFFh; retf 1_2_0794560A
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_0794B3E5 push 8BFFFFFDh; retf 1_2_0794B3EA
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_079482A0 push ebp; iretd 1_2_079482A1
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_079490D0 pushad ; iretd 1_2_079490D1
Source: C:\ProgramData\Stellar Generator.exe Code function: 1_2_07967E01 push ecx; retf 1_2_07967E02
Source: C:\ProgramData\AdobeIPC.exe Code function: 2_2_00007FFD9B7F12FA push ebx; retf 2_2_00007FFD9B7F132A
Source: C:\ProgramData\AdobeIPC.exe Code function: 2_2_00007FFD9B7F00AD pushad ; iretd 2_2_00007FFD9B7F00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_00007FFD9B6DD2A5 pushad ; iretd 4_2_00007FFD9B6DD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_00007FFD9B7F00AD pushad ; iretd 4_2_00007FFD9B7F00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_00007FFD9B8C2316 push 8B485F92h; iretd 4_2_00007FFD9B8C231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_00007FFD9B6ED2A5 pushad ; iretd 7_2_00007FFD9B6ED2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_00007FFD9B80C2C5 push ebx; iretd 7_2_00007FFD9B80C2DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_00007FFD9B8019D2 pushad ; ret 7_2_00007FFD9B8019E1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_00007FFD9B8000AD pushad ; iretd 7_2_00007FFD9B8000C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_00007FFD9B8D2316 push 8B485F91h; iretd 7_2_00007FFD9B8D231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_00007FFD9B6BD2A5 pushad ; iretd 12_2_00007FFD9B6BD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_00007FFD9B7D5F0F push ebx; iretd 12_2_00007FFD9B7D5F12
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_00007FFD9B7D19DA pushad ; ret 12_2_00007FFD9B7D19E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_00007FFD9B7D00AD pushad ; iretd 12_2_00007FFD9B7D00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_00007FFD9B8A2316 push 8B485F94h; iretd 12_2_00007FFD9B8A231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_00007FFD9B6ED2A5 pushad ; iretd 14_2_00007FFD9B6ED2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_00007FFD9B8000AD pushad ; iretd 14_2_00007FFD9B8000C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_00007FFD9B8D2316 push 8B485F91h; iretd 14_2_00007FFD9B8D231B
Source: C:\ProgramData\AdobeIPC Code function: 18_2_00007FFD9B7F00AD pushad ; iretd 18_2_00007FFD9B7F00C1
Source: C:\ProgramData\AdobeIPC.exe Code function: 19_2_00007FFD9B7F00AD pushad ; iretd 19_2_00007FFD9B7F00C1
Source: C:\ProgramData\AdobeIPC.exe Code function: 20_2_00007FFD9B7E00AD pushad ; iretd 20_2_00007FFD9B7E00C1
Source: C:\ProgramData\AdobeIPC Code function: 22_2_00007FFD9B8000AD pushad ; iretd 22_2_00007FFD9B8000C1
Source: jcMcDQ11pZ.exe, XxrMCzRlJKexMiGJO0rQe5.cs High entropy of concatenated method names: '_7iyfttC9QUHRFpMtWlj9G8', 'LTStOxm6o06DpDWX1YebAa', 'EBrtFXkYAZE0l6s9dlSIaW', 'JIuTObGE4dK8fNpyherdAF', 'EkC3YjlUdmYiqFRdQayZ26', 'VzLZKsSHZ1Vxe7lMbQQdKY', '_5Us3FWuzENasWPWwCcCRoc', 'aAeGmdX2zLHrQLdglGM1ON', '_72ibmEP7aT3fTp2l2RpKY9', 'nFOBJp3PViUONe8FNuZF8f'
Source: jcMcDQ11pZ.exe, Nl6RWFakNiX82ri4jlRLlb.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'O2lj893MD3aEIHT3ocd7pJ', '_3zL2ujUnx2cfeXWwXpzlEN', 'UNu8v2RPvuvx6j6ljTFOEO', 'A4KRGpPbfxpkHdxmrHMoRX'
Source: AdobeIPC.exe.0.dr, DwVEVORXa0k6LEYwoevm3yZNBVGZjcVux2a8U7rAy4KoxuuiTrJvVYcflf35dX3FRTTou7L.cs High entropy of concatenated method names: '_4iQdT7d8CvwfohMAAQK9lxRGO3ZKeZ4SHfSteQQzalo96B5hQvF7V0KCtx1VbB0YVnqwAu5', '_7r5nuoruIPgnzFoq2kcxah6H4D8Sba4X8Xn3hEh2UVQFLJ80NCR79dn5ISgo8NWeIEMLpP5', 'sTUQxxqefufq609QRcIme8oPRQVUbmUS3XkWIwufrDnsdm3Vi1MI6dWQ4FcXJIeMxdDKyaJ', 'LuckQ4BBIeQbM9', 'ei6z9eerq7547k', 'hx8T9Mch9refsG', 'CZrWOpxkpmHmwc', '_9m3CaP48zN87lZ', 'ht1HavQdqQpFeN', 'etIeXmsMn0Nen6'
Source: AdobeIPC.exe.0.dr, 42GOl0TRAaqhanPSkbn1cKh4nJFTFQNWzK8GFP52llPRduYQSSkxWv.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'ClKiQvUsnL1WbCa89tzuoEBJRz57yMFPVQHuhDDPZq7zWjWuofUgwwAFgYe9YQDGTzkKyRa', 'VYE6ksHTgwBuRiODK1EM5DFt0hh6NZq8czdxal5EMyZrwBnq91tIKa898irO5a6gDzyptYU', 'mZKSeqgDHORImL', 'HMOiNJZglynVaa'
Source: AdobeIPC.exe.0.dr, xLyqGwpuVDngJAR7ygvkm4XBFmOD1AHQAzvvxcZvj74RpeGAGy2N2z.cs High entropy of concatenated method names: 'xomnKdzx4nMbUQEhsuFFfYJOVnOz4QLx3Au0Iwr3QT19989gMrXfhf', '_4P3eA3JVndfRDnBYwCPShXM1xEYCV8pFB2lx6tDnPhBqMFpjYP0LIW', 'uIs3FBSOmGVd4op4qCVNqfeWSibpSUIiD4241mgD4oMTj6suCxHMyw', '_62z2E02rbhS2mFX3yAX78ub0uzy0aBSFqsgNheL6yYQ70Ep7I6KS1G', 'hAXZWUL0VwrasyFGUn42QPYYOiavATCgclBCgRVklzeYXxvgblEeaz', 'z6SSi09Txr8qk98ffIz6896zUUeDLTFdHei0n2HW2jlHsY8b0sHNY8', 'lrbXten3k5yJZM3UevoKJOLDnN8MoalArVtqDSbgyZQbbfkZrqlmS0', 'roclW7HrEwml5MapHUjfFS7yKnCcwMCPiPaCYCV3Enhjj4x4KLSBnf', 'QjxHRhpj9QHLH92OUHqd2Doft6mMFnoTFxxMWtH6bIZfDEl0v3w0Xd', 'cITS94LwZ3QdUztoVUpPhGd1N0gr4UwKVGys0FZ21Dhs22koaRBw0H'
Source: AdobeIPC.exe.0.dr, a385uvrhOk8gaPDbowFLRGLshXIADCxjr0wu3iJz6DYUUSHJNj6GxUvIy5ybfTZKYI4aN5eEnAD9v4aVqDVMDz.cs High entropy of concatenated method names: 'usn1YuaSOuwZjTFD8wCYpM3sTDC11b07MP4SPwR38glwkadyamjE8Cbd55pV1gdLXMtTbcJGCM01j2uhdyk9rr', '_5JIdemUMLDCt3pDZXpR1LZJUdnBp71THt2gtjBJWHSzlOie109IcknvsPq7i3kTnlqhpKHibRxbz7vaA81BwjE', 'qPOF5X1w0SUgzvomSPcFzCRoXA9s3YtYV942CRc849rWRA6t3ao8O5v7LcJi9lrZITflnMswkDO9sc8FcXlbDw', 'oJymLct4KrWKev5ZaVvjnNKcDSYyVfbQomwkVN4quidAhudqso0K7EPjxmphPWeDkWBftYbqxaQetnMsIJmSgO', 'w1LPWEoOcfSExTey9vfghwkCZMr4Erw5s78w45KBfIPBW5UvuJ1MHo2ZGUaWpYZSRMNRYyDkimClhx8RYqO7HE', 'y9R8a3MT7cWHMWLBep3rEoTmbudAkbQbcjrpcFVyEIXyGtb1jiKO7MuHfTNL4U9ieJmKoLjq2yM18RfJxSHikj', 'MWPPgKpeOUTeiaW4RdtRINdit5OSKuxiRBkW2RXOE2ZVJ9Ny91CAmi2DvwGNQ1hOs1XB32yT8hqiHL1M418sKs', 'hEiFQVEJJcUR6QN0h5Xqv2R0rzrJRNzZEo0l4pcgZaS7DAGNrIRmjmDN1Or2TDElFSptQPRfOiS4Xg395x6ZBR', 'zQsZSIu0ifb9dLhRQSOovvhQw6Eq39xFF9biSRKpcmP7tiJk9QWOuzz406HF0tmnfOsMdU4O9jjZac0pT3u9xa', 'n5anullFst3ilk2V4abnedECt67tBCiqA7QuByARIFSjlZzcR3rF5E3ZqmdeMhM0ncYeQDhhsGTyW0MZItk4DC'
Source: AdobeIPC.exe.0.dr, ZeafdKOuQAsPvepznrLMyG9IcGmO2YmjtRHNedHE37ccoL5fG1ROUQ.cs High entropy of concatenated method names: 'UCKgsSyO9YYAsQlQxR41D39TilPK7mJQudtitpqRYUf8EAlj4KQLSF', 'nS8VmyCawP6n6XG3IOpXneE7m46LoyRB8bSf3lXVqOO6zLxkMQa4RD', '_2rZ0jYNqA38RPeBaLc90QrhN6N3QqT3PrmzXhgjzu6BTuc5U6hx3tt', 'Fykc1QrhvcSeRUjJSeTybsFNqFrzw1bPJe70wzaQdoV0YoInAItgrQ', 'ij9wBJ9SZrg44dTB06UMUE003LpmPxWMurY4lGdqjP9eInKlTesZ3T', 'FR372aLwcbSuqPVF5YlbytCDDnNcAfqaFUhO6CkfVROxmyVodRz1px', 'lDubYrlGe7u45w', 'y6ZXeiEouaxNki', 'zmKFEZB226Xvp5', '_8WN99JAusLmOvi'
Source: AdobeIPC.exe.0.dr, EENsKBXj9If4zl9BgUFZK0AQ4c67dsMS7d04eXpCjVnRb2KQZup5tMy6gHiUKhmiwIj78Bk9vufCT4MgWL1qQd.cs High entropy of concatenated method names: 'S2aTVR7vIQwnTcQ6CTDfeWHz8mK1l2cMWtguCO6bGUJ82GHMPrDD3H1Qw2cLDCArDxLpBvWRyEkTCcivHAER90', 'lsQ4JdJN5boB2o', 'iSXac5TOalxcAt', 'mfTKr0M43cd6SH', 'DCmviZJSsf0EJU'
Source: AdobeIPC.exe.0.dr, pwQiXouLVN1VCfvmNj63gtdkbSoOiCXIXkcN4rR5BAMfhUjMdaPIP8PqXZWKcuqrB9Ez6bk.cs High entropy of concatenated method names: 'cwNdWVYLl7FMAW6AMdDrVm65qCKleHVXW1L4afkrkiOzSmIDUVVdoCvLiz9j4fD8rB7cnG7', 'VV3uKmGVqIrInMXjXlFd9rtfqOUWtM9q5yPSYK1WND8nAmTOwLl4BUov3cqNbQEYPfBrQXC', 'PM1Hp2LsrBC8Rvq42PvM3jU8LrdB3LI3tS9jMyoJTNMhzkBXJ8tNcDlPJzVZWVfLNJpQU4e', 'NOe0DuXgjjkE2XZDgXF7dth516gs0plEQeE5otUpta59O76NF1ZJ8Oy8noKdRtVWhFAs2Tx', 'cqZ4pIVYyvXXDv', 'awkyWQtW7uYHvV', 'hu8L9aWw4PxMdg', 'uB6R4nzPEqSgIz', 'skLLZVOVxUwqtC', 'YWpb6lmHpcxMHT'
Source: AdobeIPC.exe.0.dr, LntDY2IhXEuXaGfzCW2VAtwJLDlCFdkQcuX2sazFTQbIqpnWdFiD5S.cs High entropy of concatenated method names: 'ul8fthY7LLq05c52RcyNvNrJlfnhHB6UN0fxJPF6HcxA2pIbstIKNM', 'G7vo49FMzSXDUrMAiad0xCFBaVYDP3bsyj8KPfrt0kwTwL4bdPpWjR', 'bK7WonU1TPUITVxYGnQw6G6WcE3Ea8dd3g4jnPdg9BN9VbVUPMrSBy', 'CRzKmDARNW5zZvzPplAyeTeDgHzaTwwg780aVProDS3HSzOFXgGpBO', 'OxZehuL9TKisla60kz6wQ6VF99e98qDGexQgwlpGKSNnWTKr2zAx1u', 'fBdBfO11228Am3ZwmUPA8O3VintuiqPSW3n5IAARohoiCHNPhhZEBk', 'sYWQNh2IgmK9YlKrCJyo8GMXsTDN4L9kvJukcbkgcfvStwjoQNSREw', 'Qk6IaY85qf2wQKm4ABTsLxm4PwXZXA92AwWwfTxL9Gh6EYoJFgJeGM', 'v0rWoSivlUbuoGkadWKPA7QBlisAuQf4VOojdv601zpSPvhgP0mHV6', 'ue8CqKUnhzaoz4s42bpB2EHGUEYQHAstHYNVBNkM9jgkO9b7DuV4Dh'
Source: AdobeIPC.exe.0.dr, sdBBZUb8ihBfnvhHYXYv16FS7igqRtC1qMic9XBri8Xj2XQeIftSlA4GdJKPeIR60HkdmwU.cs High entropy of concatenated method names: 'zPnhI38sQdn2IkTZxTF1gEGhR35Db0ImKvUY43ru2oYHJf3CBQ15s5aiRWK0iqTHJ5Qmcp7', 'tYVsDZt05XuSb0nOEVltFlJ11z9tRWECURcNyNoZsTZgmPdxSGjvJmVzCpYyqn5XCPrHTYR', 'LPPKWAygOBq5Y9cZ1UaFCHo2QmWYts6GYDlrPCScEe5yLGrPHILEP1ggTPwaMMLJl00vqND', 'waOgjVBE2d4c5DDRzkP4GzZbzp8N47HyJWcHdph1AEG4mgCGF4O1xKjK3iNyu6VDolYhfZh', 'WkjzuMUwCzoAvrvSYKE8l6tlrKlmn7CToaxQu6wVhww27vfLXaNhyzHVbnn56x3iBC4r9e0', 'PtKp5yA40yt5zRWqNim8fOEN7mRZQUzxWlOs0FA6qGPJ3qeRjgqMXdzUaTKzCTqSCv5pCMg', '_5JUFyV8IhDptFctwStTC2jOXX1Aq79wRqn6wq7bxA0ALGZqgvpVWp0IXohRnKo68kgZbzjp', 'O3LLEUDiwiAYWSBtGHqIOSJtHXzZMC8lWQgWTSUnFLGnJMWAR22DuiSJXtA39amy51OcBlZ', '_3tqxQgCspgibE7fMgw0lplAR3hgfdvBW5D5ZMME4dolb4jB0X1ZEnPFyHoIRke7WgtlQ02j', 'mSbnUpSjzS2UVc8rrCMaALDLPefZOuSbWXWQv5gGrCUXEdEU6xV0LchXcee4TJkt7WeSvjm'
Drops PE files
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe File created: C:\ProgramData\Guna.UI2.dll Jump to dropped file
Source: C:\ProgramData\AdobeIPC.exe File created: C:\ProgramData\AdobeIPC Jump to dropped file
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe File created: C:\ProgramData\Stellar Generator.exe Jump to dropped file
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe File created: C:\ProgramData\AdobeIPC.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe File created: C:\ProgramData\Guna.UI2.dll Jump to dropped file
Source: C:\ProgramData\AdobeIPC.exe File created: C:\ProgramData\AdobeIPC Jump to dropped file
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe File created: C:\ProgramData\Stellar Generator.exe Jump to dropped file
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe File created: C:\ProgramData\AdobeIPC.exe Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\ProgramData\AdobeIPC.exe File created: C:\ProgramData\AdobeIPC Jump to dropped file

Boot Survival
barindex
Yara detected AsyncRAT
Source: Yara match File source: Process Memory Space: AdobeIPC.exe PID: 7364, type: MEMORYSTR
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AdobeIPC" /tr "C:\ProgramData\AdobeIPC"
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\ProgramData\AdobeIPC.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AdobeIPC.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\ProgramData\AdobeIPC.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AdobeIPC.lnk Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeIPC Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeIPC Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AsyncRAT
Source: Yara match File source: Process Memory Space: AdobeIPC.exe PID: 7364, type: MEMORYSTR
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Memory allocated: C10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Memory allocated: 1AA00000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Memory allocated: 1420000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Memory allocated: 2BE0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Memory allocated: 4BE0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Memory allocated: 1040000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Memory allocated: 1ACE0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\AdobeIPC Memory allocated: 1150000 memory reserve | memory write watch
Source: C:\ProgramData\AdobeIPC Memory allocated: 1AD70000 memory reserve | memory write watch
Source: C:\ProgramData\AdobeIPC.exe Memory allocated: 800000 memory reserve | memory write watch
Source: C:\ProgramData\AdobeIPC.exe Memory allocated: 1A350000 memory reserve | memory write watch
Source: C:\ProgramData\AdobeIPC.exe Memory allocated: 10B0000 memory reserve | memory write watch
Source: C:\ProgramData\AdobeIPC.exe Memory allocated: 1ACD0000 memory reserve | memory write watch
Source: C:\ProgramData\AdobeIPC Memory allocated: C80000 memory reserve | memory write watch
Source: C:\ProgramData\AdobeIPC Memory allocated: 1AAC0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AdobeIPC Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AdobeIPC.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AdobeIPC.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AdobeIPC Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\ProgramData\AdobeIPC.exe Window / User API: threadDelayed 5147 Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Window / User API: threadDelayed 4626 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6519 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3114 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7996 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1573 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6067
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3559
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7641
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2042
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Dropped PE file which has not been started: C:\ProgramData\Guna.UI2.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe TID: 7308 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe TID: 7644 Thread sleep time: -35971150943733603s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7972 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4600 Thread sleep count: 6067 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4600 Thread sleep count: 3559 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 432 Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6412 Thread sleep count: 7641 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6964 Thread sleep count: 2042 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7296 Thread sleep time: -4611686018427385s >= -30000s
Source: C:\ProgramData\AdobeIPC TID: 7880 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\AdobeIPC.exe TID: 3332 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\AdobeIPC.exe TID: 824 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\AdobeIPC TID: 7924 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\AdobeIPC.exe File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\AdobeIPC File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AdobeIPC Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AdobeIPC.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AdobeIPC.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AdobeIPC Thread delayed: delay time: 922337203685477
Source: AdobeIPC.exe, 00000002.00000002.3026731845.000000001B8C0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"0
Source: AdobeIPC.exe, 00000002.00000002.2956849178.0000000001122000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\ProgramData\AdobeIPC.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\ProgramData\AdobeIPC.exe Process token adjusted: Debug Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\ProgramData\AdobeIPC Process token adjusted: Debug
Source: C:\ProgramData\AdobeIPC Process token adjusted: Debug
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC.exe'
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC'
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC.exe' Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC' Jump to behavior
Bypasses PowerShell execution policy
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC.exe'
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process created: C:\ProgramData\Stellar Generator.exe "C:\ProgramData\Stellar Generator.exe" Jump to behavior
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Process created: C:\ProgramData\AdobeIPC.exe "C:\ProgramData\AdobeIPC.exe" Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC.exe' Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AdobeIPC.exe' Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC' Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AdobeIPC' Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AdobeIPC" /tr "C:\ProgramData\AdobeIPC" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Queries volume information: C:\Users\user\Desktop\jcMcDQ11pZ.exe VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\ProgramData\Stellar Generator.exe VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\ProgramData\Guna.UI2.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\ProgramData\Stellar Generator.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Queries volume information: C:\ProgramData\AdobeIPC.exe VolumeInformation Jump to behavior
Source: C:\ProgramData\AdobeIPC.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\ProgramData\AdobeIPC Queries volume information: C:\ProgramData\AdobeIPC VolumeInformation
Source: C:\ProgramData\AdobeIPC.exe Queries volume information: C:\ProgramData\AdobeIPC.exe VolumeInformation
Source: C:\ProgramData\AdobeIPC.exe Queries volume information: C:\ProgramData\AdobeIPC.exe VolumeInformation
Source: C:\ProgramData\AdobeIPC Queries volume information: C:\ProgramData\AdobeIPC VolumeInformation
Source: C:\Users\user\Desktop\jcMcDQ11pZ.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Yara detected AsyncRAT
Source: Yara match File source: Process Memory Space: AdobeIPC.exe PID: 7364, type: MEMORYSTR
AV process strings found (often used to terminate AV products)
Source: AdobeIPC.exe, 00000002.00000002.3041713254.000000001CA56000.00000004.00000020.00020000.00000000.sdmp, AdobeIPC.exe, 00000002.00000002.2956849178.0000000001140000.00000004.00000020.00020000.00000000.sdmp, AdobeIPC.exe, 00000002.00000002.3026731845.000000001B8C0000.00000004.00000020.00020000.00000000.sdmp, AdobeIPC.exe, 00000002.00000002.3026731845.000000001B95F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\ProgramData\AdobeIPC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected XWorm
Source: Yara match File source: 0.2.jcMcDQ11pZ.exe.2a341a0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.jcMcDQ11pZ.exe.2a341a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.AdobeIPC.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1714234137.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.1711447769.0000000000AF2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: jcMcDQ11pZ.exe PID: 7284, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AdobeIPC.exe PID: 7364, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\AdobeIPC, type: DROPPED
Source: Yara match File source: C:\ProgramData\AdobeIPC.exe, type: DROPPED

Remote Access Functionality
barindex
Yara detected XWorm
Source: Yara match File source: 0.2.jcMcDQ11pZ.exe.2a341a0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.jcMcDQ11pZ.exe.2a447e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.jcMcDQ11pZ.exe.2a341a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.AdobeIPC.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1714234137.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.1711447769.0000000000AF2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: jcMcDQ11pZ.exe PID: 7284, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AdobeIPC.exe PID: 7364, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\AdobeIPC, type: DROPPED
Source: Yara match File source: C:\ProgramData\AdobeIPC.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1532622 Sample: jcMcDQ11pZ.exe Startdate: 13/10/2024 Architecture: WINDOWS Score: 100 55 pastebin.com 2->55 61 Found malware configuration 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 Antivirus / Scanner detection for submitted sample 2->65 69 12 other signatures 2->69 9 jcMcDQ11pZ.exe 7 2->9         started        12 AdobeIPC 2->12         started        15 AdobeIPC.exe 2->15         started        17 2 other processes 2->17 signatures3 67 Connects to a pastebin service (likely for C&C) 55->67 process4 file5 47 C:\ProgramData\Stellar Generator.exe, PE32 9->47 dropped 49 C:\ProgramDatabehaviorgraphuna.UI2.dll, PE32 9->49 dropped 51 C:\ProgramData\AdobeIPC.exe, PE32 9->51 dropped 53 C:\Users\user\AppData\...\jcMcDQ11pZ.exe.log, CSV 9->53 dropped 19 AdobeIPC.exe 15 6 9->19         started        24 Stellar Generator.exe 2 9->24         started        81 Antivirus detection for dropped file 12->81 83 Multi AV Scanner detection for dropped file 12->83 85 Machine Learning detection for dropped file 12->85 signatures6 process7 dnsIp8 57 pastebin.com 172.67.19.24, 443, 49768 CLOUDFLARENETUS United States 19->57 59 193.161.193.99, 46070, 49774, 49803 BITREE-ASRU Russian Federation 19->59 45 C:\ProgramData\AdobeIPC, PE32 19->45 dropped 71 Antivirus detection for dropped file 19->71 73 Multi AV Scanner detection for dropped file 19->73 75 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->75 77 5 other signatures 19->77 26 powershell.exe 23 19->26         started        29 powershell.exe 23 19->29         started        31 powershell.exe 19->31         started        33 2 other processes 19->33 file9 signatures10 process11 signatures12 79 Loading BitLocker PowerShell Module 26->79 35 conhost.exe 26->35         started        37 conhost.exe 29->37         started        39 conhost.exe 31->39         started        41 conhost.exe 33->41         started        43 conhost.exe 33->43         started        process13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
193.161.193.99
 unknown Russian Federation
198134 BITREE-ASRU false
172.67.19.24
 pastebin.com United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
pastebin.com 172.67.19.24 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://pastebin.com/raw/LsuynkUz true unknown