File name:

ntwlk.ps1

Full analysis: https://app.any.run/tasks/07ae5786-7357-4eca-ba58-d20a6b016be9
Verdict: Malicious activity
Threats:

Netwalker is ransomware — it belongs to a malware family which encrypts files and demands users to pay a ransom to get their data back. Netwalker utilizes several sophisticated techniques, such as process hollowing and code obfuscation to target corporate victims.

Malware Trends Tracker     >>>
Analysis date: February 04, 2021, 19:11:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
netwalker
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

B00A80F645DFEEA15C54C9F1BE228705

SHA1:

D8D54FC79318030C2DD075C66F3ACC06DA0C6C7F

SHA256:

9A601B6A24298764D589E0D9BF5D48AB0A3F472E013CE0480DD87F60083549B1

SSDEEP:

24576:mij9mvisbVnmQWqzE9G3sDGERYeKBIZcwMfXzz4N6X61yMXJrpuWcWOeTeJLDx48:0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts Visual C# compiler

      • powershell.exe (PID: 2476)

    • Renames files like Ransomware

      • explorer.exe (PID: 656)

    • Netwalker ransom note found

      • explorer.exe (PID: 656)

    • Application was injected by another process

      • explorer.exe (PID: 656)

    • Runs injected code in another process

      • powershell.exe (PID: 2476)

    • Drops executable file immediately after starts

      • explorer.exe (PID: 656)

    • Modifies files in Chrome extension folder

      • explorer.exe (PID: 656)

  • SUSPICIOUS

    • PowerShell script executed

      • powershell.exe (PID: 2476)

    • Creates files in the user directory

      • powershell.exe (PID: 2476)
      • explorer.exe (PID: 656)

    • Drops a file with a compile date too recent

      • csc.exe (PID: 2940)
      • explorer.exe (PID: 656)

    • Drops a file that was compiled in debug mode

      • csc.exe (PID: 2940)

    • Creates files like Ransomware instruction

      • explorer.exe (PID: 656)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 2940)

    • Reads the cookies of Google Chrome

      • explorer.exe (PID: 656)

    • Creates files in the program directory

      • explorer.exe (PID: 656)

  • INFO

    • Dropped object may contain TOR URL's

      • explorer.exe (PID: 656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
inject start powershell.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs #NETWALKER explorer.exe notepad.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
656C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
1856C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESB302.tmp" "c:\Users\admin\AppData\Local\Temp\CSCB301.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
2476"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\ntwlk.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2564"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\kl7shsd6.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2940"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\pdxxzhbz.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3356C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESB3FC.tmp" "c:\Users\admin\AppData\Local\Temp\CSCB3FB.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
6700"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\48B26C-Readme.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
8988C:\Windows\system32\notepad.exe "C:\Users\admin\Desktop\48B26C-Readme.txt"C:\Windows\system32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
2 889
Read events
2 808
Write events
81
Delete events
0

Modification events

(PID) Process:(656) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(656) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:@"%systemroot%\system32\windowspowershell\v1.0\powershell.exe",-111
Value:
Performs object-based (command-line) functions
(PID) Process:(2476) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2476) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2476) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(656) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
Value:
00000000000000000000000000000000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000
(PID) Process:(656) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000690000009D0000000C3446001000000034000000869716007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000001CE5A3009B62D0760B7C6697FEFFFFFFFA53CB76F5F3C774E6F4C774245C13E1A8E5A300C110000000000000C00001000000000000000000A8E5A30024E5A3003851CB76C0000100820200000100000000000000000000006CE5A300D150CB76C00001008202000001000000E850CB7667CD0EE182020000E8A21C000000000000000000000000003CE5A300D0E5A300A8E7A3009B62D076FB786697FEFFFFFFE850CB762A00C874C000010082020000010000000000000000000000E8A21C0054FFC774C000010001000000FFFFFFFFFFFFFFFF90C5CB7641C6CB764E00000000000000000000000000000074E5A30011000000483D1700403D170003EE66971CA31C00FEC5CB7640E6000007C90EE1F4E5A3008291167740E6A300944C00002BC90EE108E6A300B69C1677984CCE024C06000020E6A3000848CE022CE6A30011000000483D1700403D170020E6A3002848CE0290E60000F3CA0EE140E6A3008291167790E6A30044E6A3002795167700000000944CCE026CE6A300CD941677944CCE0218E7A3000848CE02E1941677000000000848CE0218E7A30074E6A3001000000034000000869716007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000001CE5A3009B62D0760B7C6697FEFFFFFFFA53CB76F5F3C774E6F4C774245C13E1A8E5A300C110000000000000C00001000000000000000000A8E5A30024E5A3003851CB76C0000100820200000100000000000000000000006CE5A300D150CB76C00001008202000001000000E850CB7667CD0EE182020000E8A21C000000000000000000000000003CE5A300D0E5A300A8E7A3009B62D076FB786697FEFFFFFFE850CB762A00C874C000010082020000010000000000000000000000E8A21C0054FFC774C000010001000000FFFFFFFFFFFFFFFF90C5CB7641C6CB764E00000000000000000000000000000074E5A30011000000483D1700403D170003EE66971CA31C00FEC5CB7640E6000007C90EE1F4E5A3008291167740E6A300944C00002BC90EE108E6A300B69C1677984CCE024C06000020E6A3000848CE022CE6A30011000000483D1700403D170020E6A3002848CE0290E60000F3CA0EE140E6A3008291167790E6A30044E6A3002795167700000000944CCE026CE6A300CD941677944CCE0218E7A3000848CE02E1941677000000000848CE0218E7A30074E6A3001000000034000000869716007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000001CE5A3009B62D0760B7C6697FEFFFFFFFA53CB76F5F3C774E6F4C774245C13E1A8E5A300C110000000000000C00001000000000000000000A8E5A30024E5A3003851CB76C0000100820200000100000000000000000000006CE5A300D150CB76C00001008202000001000000E850CB7667CD0EE182020000E8A21C000000000000000000000000003CE5A300D0E5A300A8E7A3009B62D076FB786697FEFFFFFFE850CB762A00C874C000010082020000010000000000000000000000E8A21C0054FFC774C000010001000000FFFFFFFFFFFFFFFF90C5CB7641C6CB764E00000000000000000000000000000074E5A30011000000483D1700403D170003EE66971CA31C00FEC5CB7640E6000007C90EE1F4E5A3008291167740E6A300944C00002BC90EE108E6A300B69C1677984CCE024C06000020E6A3000848CE022CE6A30011000000483D1700403D170020E6A3002848CE0290E60000F3CA0EE140E6A3008291167790E6A30044E6A3002795167700000000944CCE026CE6A300CD941677944CCE0218E7A3000848CE02E1941677000000000848CE0218E7A30074E6A300
(PID) Process:(656) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\abgrcnq.rkr
Value:
000000000100000001000000CF840000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF408F31D06695D60100000000
(PID) Process:(656) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000690000009D00000014A046001000000034000000869716007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000001CE5A3009B62D0760B7C6697FEFFFFFFFA53CB76F5F3C774E6F4C774245C13E1A8E5A300C110000000000000C00001000000000000000000A8E5A30024E5A3003851CB76C0000100820200000100000000000000000000006CE5A300D150CB76C00001008202000001000000E850CB7667CD0EE182020000E8A21C000000000000000000000000003CE5A300D0E5A300A8E7A3009B62D076FB786697FEFFFFFFE850CB762A00C874C000010082020000010000000000000000000000E8A21C0054FFC774C000010001000000FFFFFFFFFFFFFFFF90C5CB7641C6CB764E00000000000000000000000000000074E5A30011000000483D1700403D170003EE66971CA31C00FEC5CB7640E6000007C90EE1F4E5A3008291167740E6A300944C00002BC90EE108E6A300B69C1677984CCE024C06000020E6A3000848CE022CE6A30011000000483D1700403D170020E6A3002848CE0290E60000F3CA0EE140E6A3008291167790E6A30044E6A3002795167700000000944CCE026CE6A300CD941677944CCE0218E7A3000848CE02E1941677000000000848CE0218E7A30074E6A3001000000034000000869716007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000001CE5A3009B62D0760B7C6697FEFFFFFFFA53CB76F5F3C774E6F4C774245C13E1A8E5A300C110000000000000C00001000000000000000000A8E5A30024E5A3003851CB76C0000100820200000100000000000000000000006CE5A300D150CB76C00001008202000001000000E850CB7667CD0EE182020000E8A21C000000000000000000000000003CE5A300D0E5A300A8E7A3009B62D076FB786697FEFFFFFFE850CB762A00C874C000010082020000010000000000000000000000E8A21C0054FFC774C000010001000000FFFFFFFFFFFFFFFF90C5CB7641C6CB764E00000000000000000000000000000074E5A30011000000483D1700403D170003EE66971CA31C00FEC5CB7640E6000007C90EE1F4E5A3008291167740E6A300944C00002BC90EE108E6A300B69C1677984CCE024C06000020E6A3000848CE022CE6A30011000000483D1700403D170020E6A3002848CE0290E60000F3CA0EE140E6A3008291167790E6A30044E6A3002795167700000000944CCE026CE6A300CD941677944CCE0218E7A3000848CE02E1941677000000000848CE0218E7A30074E6A3001000000034000000869716007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000001CE5A3009B62D0760B7C6697FEFFFFFFFA53CB76F5F3C774E6F4C774245C13E1A8E5A300C110000000000000C00001000000000000000000A8E5A30024E5A3003851CB76C0000100820200000100000000000000000000006CE5A300D150CB76C00001008202000001000000E850CB7667CD0EE182020000E8A21C000000000000000000000000003CE5A300D0E5A300A8E7A3009B62D076FB786697FEFFFFFFE850CB762A00C874C000010082020000010000000000000000000000E8A21C0054FFC774C000010001000000FFFFFFFFFFFFFFFF90C5CB7641C6CB764E00000000000000000000000000000074E5A30011000000483D1700403D170003EE66971CA31C00FEC5CB7640E6000007C90EE1F4E5A3008291167740E6A300944C00002BC90EE108E6A300B69C1677984CCE024C06000020E6A3000848CE022CE6A30011000000483D1700403D170020E6A3002848CE0290E60000F3CA0EE140E6A3008291167790E6A30044E6A3002795167700000000944CCE026CE6A300CD941677944CCE0218E7A3000848CE02E1941677000000000848CE0218E7A30074E6A300
(PID) Process:(656) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\ABGRCNQ.RKR
Value:
000000000200000001000000CF840000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF40FE0DCF29FBD60100000000
Executable files
1
Suspicious files
189
Text files
257
Unknown types
11

Dropped files

PID
Process
Filename
Type
2476powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JDDEXL5Y1TU1QYHVHU7F.temp —
MD5:—
SHA256:—
2940csc.exeC:\Users\admin\AppData\Local\Temp\CSCB301.tmp —
MD5:—
SHA256:—
1856cvtres.exeC:\Users\admin\AppData\Local\Temp\RESB302.tmp —
MD5:—
SHA256:—
2476powershell.exeC:\Users\admin\AppData\Local\Temp\kl7shsd6.0.cs —
MD5:—
SHA256:—
2476powershell.exeC:\Users\admin\AppData\Local\Temp\kl7shsd6.cmdline —
MD5:—
SHA256:—
2564csc.exeC:\Users\admin\AppData\Local\Temp\CSCB3FB.tmp —
MD5:—
SHA256:—
2564csc.exeC:\Users\admin\AppData\Local\Temp\kl7shsd6.pdb —
MD5:—
SHA256:—
3356cvtres.exeC:\Users\admin\AppData\Local\Temp\RESB3FC.tmp —
MD5:—
SHA256:—
2564csc.exeC:\Users\admin\AppData\Local\Temp\kl7shsd6.dll —
MD5:—
SHA256:—
2564csc.exeC:\Users\admin\AppData\Local\Temp\kl7shsd6.out —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ntwlk.ps1