Windows Analysis Report
bZRL0uttVu.exe

Overview

General Information

Sample name: bZRL0uttVu.exe
renamed because original name is a hash value
Original sample name: 22a164ed481ba88df26ce7e819f2240d7fafa5b6ee2cd2993cb5fae3d566be7f.exe
Analysis ID: 1542685
MD5: a7be144ff0b871ddd45e1e0bef06faa6
SHA1: 811797d3e0ce7c5ed76ff656156a2c066f306032
SHA256: 22a164ed481ba88df26ce7e819f2240d7fafa5b6ee2cd2993cb5fae3d566be7f
Tags: BlackMatterexeuser-JAMESWT_MHT
Infos:

Detection

LockBit ransomware, TrojanRansom
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found ransom note / readme
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected LockBit ransomware
Yara detected TrojanRansom
AI detected suspicious sample
Changes the wallpaper picture
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Deletes itself after installation
Found Tor onion address
Found potential ransomware demand text
Hides threads from debuggers
Machine Learning detection for sample
May modify the system service descriptor table (often done to hook functions)
Modifies existing user documents (likely ransomware behavior)
Overwrites Mozilla Firefox settings
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Writes many files with high entropy
Writes to foreign memory regions
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to clear windows event logs (to hide its activities)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Enables debug privileges
Enables security privileges
PE file contains an invalid checksum
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Potentially Suspicious Desktop Background Change Via Registry
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: bZRL0uttVu.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: bZRL0uttVu.exe ReversingLabs: Detection: 89%
Source: bZRL0uttVu.exe Virustotal: Detection: 88% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.8% probability
Machine Learning detection for sample
Source: bZRL0uttVu.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: bZRL0uttVu.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Videos\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Searches\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Saved Games\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Recent\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Pictures\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Pictures\Saved Pictures\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Pictures\Camera Roll\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\OneDrive\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Music\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Links\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Favorites\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Favorites\Links\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Downloads\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\ZTGJILHXQB\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\ZGGKNSUKOP\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\WKXEWIOTXI\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\VAMYDFPUND\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\SUAVTZKNFL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\SQRKHNBNYN\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\SFPUSAFIOL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\QCFWYSKMHA\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\NVWZAPQSQL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\KLIZUSIQEN\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\IPKGELNTQY\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\BJZFPPWAPT\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\ZTGJILHXQB\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\ZGGKNSUKOP\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\WKXEWIOTXI\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\VAMYDFPUND\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\SUAVTZKNFL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\SQRKHNBNYN\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\SFPUSAFIOL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\QCFWYSKMHA\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\NVWZAPQSQL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\KLIZUSIQEN\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\IPKGELNTQY\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\BJZFPPWAPT\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Contacts\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Skype\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Skype\RootTools\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Headlights\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\d1702bdf-c0c8-42c3-b6d9-e52fd0a57b16\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\assets\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\VirtualStore\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Low\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrocef_low\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\SolidDocuments\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Publishers\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\PeerDistRepub\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e65614a4-2986-4163-aa7c-1a44d47f3a43}\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{59b571a3-bca9-49e1-9e72-2d4acd92de8f}\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: bZRL0uttVu.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\* source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\OC9oMrMV8.README.txt source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931328290.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdbt source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931101345.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931328290.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorf source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1941775019.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WINLOA~1.PDBwinload_prod.pdb source: bZRL0uttVu.exe, 00000000.00000003.1931101345.000000000102D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdbDfm source: bZRL0uttVu.exe, 00000000.00000003.2036295728.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2165324053.0000000000FEC000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2033607403.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: bZRL0uttVu.exe, 00000000.00000003.1948145687.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946286107.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946947383.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1944750528.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946723113.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1947379445.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1948665557.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1945621591.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1943279731.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1941775019.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1945389844.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1945168816.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1948893367.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1944518697.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946071110.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1944256581.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1948377867.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1944959541.0000000001053000.00000004.0
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\ source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.OC9oMrMV8] source: bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.OC9oMrMV8> source: bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ownload.error source: bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1941775019.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mi_exe_stub.pdb source: bZRL0uttVu.exe, 00000000.00000003.1930302255.000000000106F000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1930390191.0000000001082000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.OC9oMrMV8xxt2 source: bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1941775019.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorQ source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: bZRL0uttVu.exe, 00000000.00000003.1948145687.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1965963769.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1966198899.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946286107.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1963497816.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1964883022.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946947383.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1956942295.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1949637001.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1966472682.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1951470561.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1962219875.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1944750528.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1963268673.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1964076160.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946723113.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1965449997.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1947379445.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1962483111.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1962751919.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1964368306.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1949856514.0000000001053000.00000004.0
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.OC9oMrMV8 source: bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\OC9oMrMV8.README.txt source: bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A5C24 FindFirstFileW,FindClose,FindNextFileW,FindClose, 0_2_005A5C24
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AA094 FindFirstFileExW,FindClose, 0_2_005AA094
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A74BC FindFirstFileExW,FindNextFileW, 0_2_005A74BC
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A7590 FindFirstFileExW,FindClose, 0_2_005A7590
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A766C FindFirstFileExW,GetFileAttributesW,FindNextFileW, 0_2_005A766C
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AF308 GetFileAttributesW,SetThreadPriority,FindFirstFileExW,FindNextFileW,FindClose, 0_2_005AF308
Source: C:\ProgramData\B0BE.tmp Code function: 8_2_0040227C FindFirstFileExW, 8_2_0040227C
Source: C:\ProgramData\B0BE.tmp Code function: 8_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose, 8_2_0040152C
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AA470 GetLogicalDriveStringsW, 0_2_005AA470
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\ Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Local\Temp\Diagnostics\ Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\ Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\ Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\ Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\ Jump to behavior

Networking
barindex
Found Tor onion address
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionalq
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionicd
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionl
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onione
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.oniond
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion?
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion"
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion]U
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion]x
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionk
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.oniong
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionic
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionl
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion)
Source: bZRL0uttVu.exe, 00000000.00000003.2235149700.0000000001066000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: O^partitionKey=%28https%2Cmozilla.org%29,:https://www.mozilla.org/media/protocol/img/icons/social/twitter/white.79fc9d8867ed.svg equals www.twitter.com (Twitter)
Source: bZRL0uttVu.exe, 00000000.00000003.2230202222.00000000010A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: content-security-policy: script-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com *.mozilla.org 'unsafe-inline' 'unsafe-eval' www.googletagmanager.com www.google-analytics.com tagmanager.google.com www.youtube.com s.ytimg.com cdn-4.convertexperiments.com app.convert.com data.track.convertexperiments.com 1003350.track.convertexperiments.com 1003343.track.convertexperiments.com js.stripe.com; default-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com *.mozilla.org; style-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com *.mozilla.org 'unsafe-inline' app.convert.com; frame-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com *.mozilla.org www.googletagmanager.com www.google-analytics.com www.youtube-nocookie.com trackertest.org www.surveygizmo.com accounts.firefox.com accounts.firefox.com.cn www.youtube.com js.stripe.com; font-src 'self'; child-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com *.mozilla.org www.googletagmanager.com www.google-analytics.com www.youtube-nocookie.com trackertest.org www.surveygizmo.com accounts.firefox.com accounts.firefox.com.cn www.youtube.com js.stripe.com; img-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com *.mozilla.org data: mozilla.org www.googletagmanager.com www.google-analytics.com creativecommons.org cdn-4.convertexperiments.com logs.convertexperiments.com images.ctfassets.net; connect-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com *.mozilla.org www.googletagmanager.com www.google-analytics.com region1.google-analytics.com logs.convertexperiments.com 1003350.metrics.convertexperiments.com 1003343.metrics.convertexperiments.com sentry.prod.mozaws.net o1069899.sentry.io o1069899.ingest.sentry.io https://accounts.firefox.com/ stage.cjms.nonprod.cloudops.mozgcp.net cjms.services.mozilla.com equals www.youtube.com (Youtube)
Source: bZRL0uttVu.exe, 00000000.00000003.1927235172.00000000010E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: bZRL0uttVu.exe, 00000000.00000003.2235149700.0000000001053000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kinto.readthedocs.io/en/latest/tutorials/synchronisation.html#polling-for-remote-changes
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt.uz
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onione
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionk
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionl
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionalq
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.oniond
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionl
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion)
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion?
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.oniong
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionic
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.000000000100A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionicd
Source: bZRL0uttVu.exe, 00000000.00000003.2230202222.00000000010A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: bZRL0uttVu.exe, 00000000.00000003.2235149700.0000000001053000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/
Source: bZRL0uttVu.exe, 00000000.00000003.2235149700.0000000001053000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/
Source: bZRL0uttVu.exe, 00000000.00000003.2235149700.0000000001053000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Kinto/kinto-attachment/
Source: bZRL0uttVu.exe, 00000000.00000003.2230202222.00000000010A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/7036968e-77d6-472d-
Source: bZRL0uttVu.exe, 00000000.00000003.2230202222.00000000010DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/96c8e907-df38-40d6-
Source: bZRL0uttVu.exe, 00000000.00000003.2235149700.0000000001053000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://remote-settings.readthedocs.io
Source: bZRL0uttVu.exe, 00000000.00000003.1888082038.0000000001142000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1888082038.000000000113A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: bZRL0uttVu.exe, 00000000.00000003.1888082038.000000000114A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: bZRL0uttVu.exe, 00000000.00000003.1888082038.000000000114A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: bZRL0uttVu.exe, 00000000.00000003.2014616809.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1990004282.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000002.2533339573.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2038133809.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1994046077.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1997058469.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1889529864.000000000100A000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1909998935.0000000001049000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1991308060.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2036295728.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2017764250.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2016922272.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1988141036.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1880162807.0000000001049000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2012826885.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1984324725.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2017462800.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2025219888.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1999965556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1891109106.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1981397782.0000000001053000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tox.chat/
Source: bZRL0uttVu.exe, 00000000.00000003.1888082038.0000000001142000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1888082038.000000000113A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: bZRL0uttVu.exe, 00000000.00000003.1888082038.000000000114A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: bZRL0uttVu.exe, 00000000.00000003.1888082038.000000000114A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: bZRL0uttVu.exe, 00000000.00000003.2230202222.00000000010A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: bZRL0uttVu.exe, 00000000.00000003.1888082038.000000000114A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: bZRL0uttVu.exe, 00000000.00000003.1888082038.000000000114A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: bZRL0uttVu.exe, 00000000.00000003.2235149700.0000000001066000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/protocol/img/icons/social/twitter/white.79fc9d8867ed.svg
Source: bZRL0uttVu.exe, 00000000.00000003.1888082038.000000000114A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Spam, unwanted Advertisements and Ransom Demands
barindex
Found ransom note / readme
Source: C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\OC9oMrMV8.README.txt Dropped file: YOUR FILES ARE ENCRYPTED!The only way to decrypt them is to buy our decryptor.Contact us on TOX messenger and decrypt one file for free, for proof of our working decryptor.Download TOX messenger: https://tox.chat/Add TOX ID: 82EB02C9FE8B50B794181CCD14F851EB23428FD265C609CD2054DA2A640008154B1FBDE043D7 Jump to dropped file
Yara detected LockBit ransomware
Source: Yara match File source: bZRL0uttVu.exe, type: SAMPLE
Source: Yara match File source: 0.0.bZRL0uttVu.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.bZRL0uttVu.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2531834489.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1860540154.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2533339573.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: bZRL0uttVu.exe PID: 6356, type: MEMORYSTR
Yara detected TrojanRansom
Source: Yara match File source: Process Memory Space: bZRL0uttVu.exe PID: 6356, type: MEMORYSTR
Changes the wallpaper picture
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Key value created or modified: HKEY_CURRENT_USER\Control Panel\Desktop WallPaper C:\ProgramData\OC9oMrMV8.bmp Jump to behavior
Found potential ransomware demand text
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : Your data are stolen and encryptedlk
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : Your data are stolen and encryptede
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : Your data are stolen and encrypted
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : Your data are stolen and encrypted?
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : Your data are stolen and encryptede)
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : Your data are stolen and encrypted#
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : Your data are stolen and encryptedl{
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : Your data are stolen and encryptedeu
Source: bZRL0uttVu.exe, 00000000.00000003.2531176819.0000000001065000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : All your important files are stolen and encrypted!
Source: bZRL0uttVu.exe, 00000000.00000003.2521006970.0000000001065000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : All your important files are stolen and encrypted!
Source: bZRL0uttVu.exe, 00000000.00000002.2533339573.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory : All your important files are stolen and encrypted!
Modifies existing user documents (likely ransomware behavior)
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File moved: C:\Users\user\Desktop\IPKGELNTQY.jpg Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File moved: C:\Users\user\Desktop\NEBFQQYWPS.pdf Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File moved: C:\Users\user\Desktop\ZTGJILHXQB.docx Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File moved: C:\Users\user\Desktop\SQRKHNBNYN.jpg Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File moved: C:\Users\user\Desktop\WKXEWIOTXI\VAMYDFPUND.pdf Jump to behavior
Writes many files with high entropy
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt.OC9oMrMV8 entropy: 7.99912656433 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt.OC9oMrMV8 entropy: 7.9995518737 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt.OC9oMrMV8 entropy: 7.99914387546 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt.OC9oMrMV8 entropy: 7.99532386514 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt.OC9oMrMV8 entropy: 7.99739426231 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{59b571a3-bca9-49e1-9e72-2d4acd92de8f}\0.0.filtertrie.intermediate.txt.OC9oMrMV8 entropy: 7.99506176889 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e65614a4-2986-4163-aa7c-1a44d47f3a43}\Apps.ft.OC9oMrMV8 entropy: 7.9962193171 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e65614a4-2986-4163-aa7c-1a44d47f3a43}\0.0.filtertrie.intermediate.txt.OC9oMrMV8 entropy: 7.99493816686 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt.OC9oMrMV8 entropy: 7.99798686082 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome.OC9oMrMV8 entropy: 7.99471813182 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB.OC9oMrMV8 entropy: 7.99487377039 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt.OC9oMrMV8 entropy: 7.99451236023 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft.OC9oMrMV8 entropy: 7.99674508614 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\wctEA40.tmp.OC9oMrMV8 entropy: 7.99742974266 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{59b571a3-bca9-49e1-9e72-2d4acd92de8f}\Apps.ft.OC9oMrMV8 entropy: 7.99654041454 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{116229A7-9A3B-2078-DB5F-B5A20811242C}.OC9oMrMV8 entropy: 7.99624242568 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help.OC9oMrMV8 entropy: 7.99531870829 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_mpnpojknpmnjdcgaaiekajbnjb.OC9oMrMV8 entropy: 7.99544867552 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_kefjledonknomlcbpllchaibag.OC9oMrMV8 entropy: 7.9955740984 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_.OC9oMrMV8 entropy: 7.9943175515 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_fmgjjmmmlfcabfkddbjimcfncm.OC9oMrMV8 entropy: 7.99535637045 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_fhihpiojkboajapmgkhlnakfjf.OC9oMrMV8 entropy: 7.99470950097 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_agimnkijcamfeangaknmldooml.OC9oMrMV8 entropy: 7.99429083023 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_aghbiahbpaeidepookljebhfak.OC9oMrMV8 entropy: 7.99510663893 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB;PrivateBrowsingAUMID.OC9oMrMV8 entropy: 7.99548856778 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334775820156800_6EB929AF-656E-4F43-9731-EA7753E1F1BD.log.OC9oMrMV8 entropy: 7.99278326191 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E7A33582-E908-3379-5368-5999454DCD83}.OC9oMrMV8 entropy: 7.99488080193 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{DAA168DE-4306-C8BC-8C11-B596240BDDED}.OC9oMrMV8 entropy: 7.99605595773 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C804BBA7-FA5F-CBF7-8B55-2096E5F972CB}.OC9oMrMV8 entropy: 7.99459011449 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C1C6F8AC-40A3-0F5C-146F-65A9DC70BBB4}.OC9oMrMV8 entropy: 7.99552480026 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BD3F924E-55FB-A1BA-9DE6-B50F9F2460AC}.OC9oMrMV8 entropy: 7.99475176072 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BB044BFD-25B7-2FAA-22A8-6371A93E0456}.OC9oMrMV8 entropy: 7.99505083741 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334923056622400_BD966DD2-7850-423A-B1D8-7882CE1A6D15.log.OC9oMrMV8 entropy: 7.99913714297 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{923DD477-5846-686B-A659-0FCCD73851A8}.OC9oMrMV8 entropy: 7.99558847163 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417072488237400_C12D9B44-3468-47BC-9418-BF0A674A2B2F.log.OC9oMrMV8 entropy: 7.99920863424 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8ABD94FB-E7D6-84A6-A997-C918EDDE0AE5}.OC9oMrMV8 entropy: 7.99487437031 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8AA47365-B2B3-1961-69EB-F866E376B12F}.OC9oMrMV8 entropy: 7.99490051157 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417101742322600_290EFEE9-C25A-4857-9F32-D7E6D51B7C09.log.OC9oMrMV8 entropy: 7.99901725983 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{16988324-21C9-05B2-CA60-9B4EC72739D8}.OC9oMrMV8 entropy: 7.99561321128 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417118050662300_8475A8C9-2447-4BC4-8E46-350AA0582B94.log.OC9oMrMV8 entropy: 7.99876793799 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App_1696413198165042300_AA3FCB9C-CF1A-4407-8A94-A7D6C220021F.log.OC9oMrMV8 entropy: 7.99873801459 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_InternetExplorer_Default.OC9oMrMV8 entropy: 7.99541357321 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.OC9oMrMV8 entropy: 7.99254551989 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{F1118828-A0CC-5FEB-85C9-DBFFDF98434A}.OC9oMrMV8 entropy: 7.99537022363 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E8B84CFB-B069-BC13-F88F-170904F645E5}.OC9oMrMV8 entropy: 7.99511295064 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OUTLOOK_EXE_15.OC9oMrMV8 entropy: 7.99522130385 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OcPubMgr_exe_15.OC9oMrMV8 entropy: 7.99520004402 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSPUB_EXE_15.OC9oMrMV8 entropy: 7.99509715855 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_msoev_exe_15.OC9oMrMV8 entropy: 7.99488016586 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSACCESS_EXE_15.OC9oMrMV8 entropy: 7.99425397813 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSOUC_EXE_15.OC9oMrMV8 entropy: 7.99452972471 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_DATABASECOMPARE_EXE_15.OC9oMrMV8 entropy: 7.99531811039 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_lync_exe_15.OC9oMrMV8 entropy: 7.99576505598 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_EXCEL_EXE_15.OC9oMrMV8 entropy: 7.99483326982 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15.OC9oMrMV8 entropy: 7.99478616014 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsCalculator_8wekyb3d8bbwe!App.OC9oMrMV8 entropy: 7.99520092524 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsAlarms_8wekyb3d8bbwe!App.OC9oMrMV8 entropy: 7.99512707143 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_SkyDrive_Desktop.OC9oMrMV8 entropy: 7.99448335461 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_WINWORD_EXE_15.OC9oMrMV8 entropy: 7.99485047762 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SPREADSHEETCOMPARE_EXE_15.OC9oMrMV8 entropy: 7.99534499039 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_ONENOTE_EXE_15.OC9oMrMV8 entropy: 7.99540440007 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_POWERPNT_EXE_15.OC9oMrMV8 entropy: 7.99514032318 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer.OC9oMrMV8 entropy: 7.99483869267 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel.OC9oMrMV8 entropy: 7.99464122879 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Computer.OC9oMrMV8 entropy: 7.9955267973 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_AdministrativeTools.OC9oMrMV8 entropy: 7.99502067285 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsStore_8wekyb3d8bbwe!App.OC9oMrMV8 entropy: 7.99452262781 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsSoundRecorder_8wekyb3d8bbwe!App.OC9oMrMV8 entropy: 7.99497083553 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite.OC9oMrMV8 entropy: 7.99807714245 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm.OC9oMrMV8 entropy: 7.99504788361 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.OC9oMrMV8 entropy: 7.9950658478 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm.OC9oMrMV8 entropy: 7.99473631412 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite.OC9oMrMV8 entropy: 7.99806453866 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db.OC9oMrMV8 entropy: 7.99919799704 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite.OC9oMrMV8 entropy: 7.9993705965 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm.OC9oMrMV8 entropy: 7.9927526174 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db.OC9oMrMV8 entropy: 7.99935275233 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite.OC9oMrMV8 entropy: 7.99683241004 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm.OC9oMrMV8 entropy: 7.99448483119 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite.OC9oMrMV8 entropy: 7.99816367511 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite.OC9oMrMV8 entropy: 7.99870250172 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.OC9oMrMV8 entropy: 7.99621515681 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.OC9oMrMV8 entropy: 7.99433820516 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.OC9oMrMV8 entropy: 7.99643763107 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.OC9oMrMV8 entropy: 7.99489076629 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.OC9oMrMV8 entropy: 7.99583421469 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.OC9oMrMV8 entropy: 7.99491878093 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.OC9oMrMV8 entropy: 7.99610310896 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.OC9oMrMV8 entropy: 7.99481731385 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.OC9oMrMV8 entropy: 7.99653352811 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.OC9oMrMV8 entropy: 7.99468038286 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.OC9oMrMV8 entropy: 7.99428048009 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash16598\13723.OC9oMrMV8 entropy: 7.99563313831 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\2B8DB5289EFF0A466C21F47412A322A36CEB5044.OC9oMrMV8 entropy: 7.99811477243 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\289DBE90018D682BDBFD59A3CAACE9EE538234FD.OC9oMrMV8 entropy: 7.99165459867 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\252CE8AC445A184A1F4A1C6C6D4ADB8AE41B7776.OC9oMrMV8 entropy: 7.99767184116 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\22F59957B7E08CD6CCFED6AF2A1DF26FE157DF40.OC9oMrMV8 entropy: 7.99843722198 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084.OC9oMrMV8 entropy: 7.99775184481 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\3C9B2D192D535C347CDA9FB12BFC88FD40CF0382.OC9oMrMV8 entropy: 7.99776070406 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\62FC1E8DCE1991EEB55DE9EFADF47EA578A22AB5.OC9oMrMV8 entropy: 7.99282159695 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\44230749A38B6989F56217B435A03E84CCADE62D.OC9oMrMV8 entropy: 7.99461510967 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\BDE5E55BCB4604200C70FB908FA76903C94590D3.OC9oMrMV8 entropy: 7.99868036277 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4.OC9oMrMV8 entropy: 7.9907903547 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4.OC9oMrMV8 entropy: 7.99115774953 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F.OC9oMrMV8 entropy: 7.99571070822 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\E707EC8A256322E87908664A49F800B7B48E0961.OC9oMrMV8 entropy: 7.99195916667 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3.OC9oMrMV8 entropy: 7.99059935199 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.OC9oMrMV8 entropy: 7.99634918987 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\11719.OC9oMrMV8 entropy: 7.99588905251 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State.OC9oMrMV8 entropy: 7.99681956776 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1.OC9oMrMV8 entropy: 7.99931344264 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\index.OC9oMrMV8 entropy: 7.99925958264 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MSEdge.OC9oMrMV8 entropy: 7.99480357027 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Shell_RunDialog.OC9oMrMV8 entropy: 7.99503981378 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_RemoteDesktop.OC9oMrMV8 entropy: 7.99536572094 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Photos_8wekyb3d8bbwe!App.OC9oMrMV8 entropy: 7.99452737083 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_MediaPlayer32.OC9oMrMV8 entropy: 7.99513779072 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msinfo32_exe.OC9oMrMV8 entropy: 7.99477234171 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_MdSched_exe.OC9oMrMV8 entropy: 7.99556101921 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_dfrgui_exe.OC9oMrMV8 entropy: 7.9950559715 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_magnify_exe.OC9oMrMV8 entropy: 7.99535256868 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_iscsicpl_exe.OC9oMrMV8 entropy: 7.99538660461 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.OC9oMrMV8 entropy: 7.99534989297 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cmd_exe.OC9oMrMV8 entropy: 7.99485589932 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cleanmgr_exe.OC9oMrMV8 entropy: 7.99546161278 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe.OC9oMrMV8 entropy: 7.99495657888 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msconfig_exe.OC9oMrMV8 entropy: 7.99486168059 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe.OC9oMrMV8 entropy: 7.99524114227 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_services_msc.OC9oMrMV8 entropy: 7.99549516281 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_RecoveryDrive_exe.OC9oMrMV8 entropy: 7.99489388348 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_quickassist_exe.OC9oMrMV8 entropy: 7.99435249535 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_psr_exe.OC9oMrMV8 entropy: 7.99552303766 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_printmanagement_msc.OC9oMrMV8 entropy: 7.994607419 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_osk_exe.OC9oMrMV8 entropy: 7.99415246773 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_odbcad32_exe.OC9oMrMV8 entropy: 7.99552885462 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_notepad_exe.OC9oMrMV8 entropy: 7.99525078598 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_narrator_exe.OC9oMrMV8 entropy: 7.99503611562 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_mspaint_exe.OC9oMrMV8 entropy: 7.9944049954 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_exe.OC9oMrMV8 entropy: 7.99399121986 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Windows NT_Accessories_wordpad_exe.OC9oMrMV8 entropy: 7.99522237916 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Common Files_Microsoft Shared_Ink_mip_exe.OC9oMrMV8 entropy: 7.99447381218 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Adobe_Acrobat DC_Acrobat_Acrobat_exe.OC9oMrMV8 entropy: 7.99543993921 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7zFM_exe.OC9oMrMV8 entropy: 7.99535917535 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7-zip_chm.OC9oMrMV8 entropy: 7.99462093048 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.OC9oMrMV8 entropy: 7.99484664042 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_powershell_exe.OC9oMrMV8 entropy: 7.99584909161 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WF_msc.OC9oMrMV8 entropy: 7.9956306959 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WFS_exe.OC9oMrMV8 entropy: 7.99450083058 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Extras.OC9oMrMV8 entropy: 7.99415966317 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Examples.OC9oMrMV8 entropy: 7.99481441811 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt_chm.OC9oMrMV8 entropy: 7.99552244759 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoItX_AutoItX_chm.OC9oMrMV8 entropy: 7.99551607482 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_x64_exe.OC9oMrMV8 entropy: 7.99493245026 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_exe.OC9oMrMV8 entropy: 7.99491662985 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt v3 Website_url.OC9oMrMV8 entropy: 7.99532132613 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_x64_exe.OC9oMrMV8 entropy: 7.9948793669 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_exe.OC9oMrMV8 entropy: 7.9951096218 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_x64_exe.OC9oMrMV8 entropy: 7.99469241868 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log.OC9oMrMV8 entropy: 7.99958086409 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\index.OC9oMrMV8 entropy: 7.99938813923 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{F38BF404-1D43-42F2-9305-67DE0B28FC23}_regedit_exe.OC9oMrMV8 entropy: 7.99492664548 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.OC9oMrMV8 entropy: 7.99938246025 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.OC9oMrMV8 entropy: 7.99490878641 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_powershell_exe.OC9oMrMV8 entropy: 7.99504274318 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_odbcad32_exe.OC9oMrMV8 entropy: 7.99503175671 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Java_jre-1_8_bin_javacpl_exe.OC9oMrMV8 entropy: 7.99456245972 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_SciTE_SciTE_exe.OC9oMrMV8 entropy: 7.9950961803 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\index.OC9oMrMV8 entropy: 7.99927478906 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log.OC9oMrMV8 entropy: 7.99959069475 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs.OC9oMrMV8 entropy: 7.99964042513 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb00001.log.OC9oMrMV8 entropy: 7.99965802211 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm.OC9oMrMV8 entropy: 7.99076622028 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs.OC9oMrMV8 entropy: 7.9996644968 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1.OC9oMrMV8 entropy: 7.99931767633 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-shm.OC9oMrMV8 entropy: 7.99452117536 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.OC9oMrMV8 entropy: 7.99449099093 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.OC9oMrMV8 entropy: 7.99263194958 Jump to dropped file
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl.OC9oMrMV8 entropy: 7.99691812023 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\bZRL0uttVu.exe entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\AAAAAAAAAAAAAA (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\BBBBBBBBBBBBBB (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\CCCCCCCCCCCCCC (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\DDDDDDDDDDDDDD (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\EEEEEEEEEEEEEE (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\FFFFFFFFFFFFFF (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\GGGGGGGGGGGGGG (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\HHHHHHHHHHHHHH (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\IIIIIIIIIIIIII (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\JJJJJJJJJJJJJJ (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\KKKKKKKKKKKKKK (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\LLLLLLLLLLLLLL (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\MMMMMMMMMMMMMM (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\NNNNNNNNNNNNNN (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\OOOOOOOOOOOOOO (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\PPPPPPPPPPPPPP (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\QQQQQQQQQQQQQQ (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\RRRRRRRRRRRRRR (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\SSSSSSSSSSSSSS (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\TTTTTTTTTTTTTT (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\UUUUUUUUUUUUUU (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\VVVVVVVVVVVVVV (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\WWWWWWWWWWWWWW (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\XXXXXXXXXXXXXX (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\YYYYYYYYYYYYYY (copy) entropy: 7.99729666549 Jump to dropped file
Source: C:\ProgramData\B0BE.tmp File created: C:\Users\user\Desktop\ZZZZZZZZZZZZZZ (copy) entropy: 7.99729666549 Jump to dropped file

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: bZRL0uttVu.exe, type: SAMPLE Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Source: 0.0.bZRL0uttVu.exe.5a0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Source: 0.2.bZRL0uttVu.exe.5a0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Source: 00000000.00000002.2531834489.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Source: 00000000.00000000.1860540154.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AB444 NtSetInformationThread, 0_2_005AB444
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AB470 NtProtectVirtualMemory, 0_2_005AB470
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005ADC60 NtTerminateProcess, 0_2_005ADC60
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005B7034 CreateThread,CreateThread,CreateThread,CreateThread,NtTerminateThread,CreateThread,CreateThread, 0_2_005B7034
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A6C98 NtQueryInformationToken, 0_2_005A6C98
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A9880 NtClose, 0_2_005A9880
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005B04B4 GetTempFileNameW,CreateFileW,WriteFile,CreateProcessW,NtQueryInformationProcess,NtReadVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,CreateNamedPipeW,ResumeThread,ConnectNamedPipe, 0_2_005B04B4
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AE1E8 CreateThread,NtClose, 0_2_005AE1E8
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A7E58 NtQuerySystemInformation,Sleep, 0_2_005A7E58
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005ADE78 SetThreadPriority,ReadFile,WriteFile,WriteFile,NtClose, 0_2_005ADE78
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AB674 NtQueryInformationToken, 0_2_005AB674
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A6668 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,NtFreeVirtualMemory,NtClose,DeleteFileW, 0_2_005A6668
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A8F68 RtlAdjustPrivilege,NtSetInformationThread, 0_2_005A8F68
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AB734 NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess, 0_2_005AB734
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A97D8 NtQuerySystemInformation, 0_2_005A97D8
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AB3C0 NtSetInformationThread,NtClose, 0_2_005AB3C0
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AC3F8 CreateFileW,WriteFile,RegCreateKeyExW,RegSetValueExW,RegCreateKeyExW,RegSetValueExW,SHChangeNotify,NtClose, 0_2_005AC3F8
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A9811 NtQuerySystemInformation, 0_2_005A9811
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A982A NtQuerySystemInformation, 0_2_005A982A
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A7E8A NtQuerySystemInformation,Sleep, 0_2_005A7E8A
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A7EA3 NtQuerySystemInformation,Sleep, 0_2_005A7EA3
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A8F66 RtlAdjustPrivilege,NtSetInformationThread, 0_2_005A8F66
Source: C:\ProgramData\B0BE.tmp Code function: 8_2_00402760 CreateFileW,ReadFile,NtClose, 8_2_00402760
Source: C:\ProgramData\B0BE.tmp Code function: 8_2_0040286C NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess, 8_2_0040286C
Source: C:\ProgramData\B0BE.tmp Code function: 8_2_00402F18 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,SetFilePointerEx,NtFreeVirtualMemory,NtClose,DeleteFileW, 8_2_00402F18
Source: C:\ProgramData\B0BE.tmp Code function: 8_2_00401DC2 NtProtectVirtualMemory, 8_2_00401DC2
Source: C:\ProgramData\B0BE.tmp Code function: 8_2_00401D94 NtSetInformationThread, 8_2_00401D94
Source: C:\ProgramData\B0BE.tmp Code function: 8_2_004016B4 NtAllocateVirtualMemory,NtAllocateVirtualMemory, 8_2_004016B4
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AA68C: GetVolumeNameForVolumeMountPointW,FindFirstVolumeW,GetVolumePathNamesForVolumeNameW,GetDriveTypeW,CreateFileW,DeviceIoControl, 0_2_005AA68C
Creates files inside the system directory
Source: C:\Windows\splwow64.exe File created: C:\Windows\system32\spool\PRINTERS\00002.SPL
Detected potential crypto function
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A80B8 0_2_005A80B8
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A20AC 0_2_005A20AC
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A4D08 0_2_005A4D08
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A4D03 0_2_005A4D03
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A5218 0_2_005A5218
Enables security privileges
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process token adjusted: Security
Uses 32bit PE files
Source: bZRL0uttVu.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: bZRL0uttVu.exe, type: SAMPLE Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: 0.0.bZRL0uttVu.exe.5a0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: 0.2.bZRL0uttVu.exe.5a0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: 00000000.00000002.2531834489.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: 00000000.00000000.1860540154.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: classification engine Classification label: mal100.rans.phis.spyw.evad.winEXE@9/1664@0/0
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\94a657af28168e38ae2672c03e3cba29
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2848:120:WilError_03
Source: C:\ProgramData\B0BE.tmp Mutant created: \Sessions\1\BaseNamedObjects\Global\{649F4E29-16CB-DD42-8922-9FFF0592856B}
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Windows\splwow64.exe File read: C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote-manifest.ini
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: bZRL0uttVu.exe ReversingLabs: Detection: 89%
Source: bZRL0uttVu.exe Virustotal: Detection: 88%
Source: unknown Process created: C:\Users\user\Desktop\bZRL0uttVu.exe "C:\Users\user\Desktop\bZRL0uttVu.exe"
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process created: C:\ProgramData\B0BE.tmp "C:\ProgramData\B0BE.tmp"
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{F24807AC-C25F-4B66-96E7-E0E93A319590}.xps" 133743940273530000
Source: C:\ProgramData\B0BE.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B0BE.tmp >> NUL
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process created: C:\ProgramData\B0BE.tmp "C:\ProgramData\B0BE.tmp"
Source: C:\ProgramData\B0BE.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B0BE.tmp >> NUL
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: gpedit.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: dssec.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: dsuiext.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: authz.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: adsldp.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\ProgramData\B0BE.tmp Section loaded: apphelp.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: rstrtmgr.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: ncrypt.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: ntasn1.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: windows.storage.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: wldp.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: kernel.appcore.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: uxtheme.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: propsys.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: profapi.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: edputil.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: urlmon.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: iertutil.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: srvcli.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: netutils.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: windows.staterepositoryps.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: sspicli.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: wintypes.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: appresolver.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: bcp47langs.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: slc.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: userenv.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: sppc.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: onecorecommonproxystub.dll
Source: C:\ProgramData\B0BE.tmp Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: bZRL0uttVu.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: bZRL0uttVu.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\* source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\OC9oMrMV8.README.txt source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931328290.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdbt source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931101345.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931328290.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorf source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1941775019.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WINLOA~1.PDBwinload_prod.pdb source: bZRL0uttVu.exe, 00000000.00000003.1931101345.000000000102D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdbDfm source: bZRL0uttVu.exe, 00000000.00000003.2036295728.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2165324053.0000000000FEC000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2033607403.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: bZRL0uttVu.exe, 00000000.00000003.1948145687.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946286107.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946947383.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1944750528.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946723113.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1947379445.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1948665557.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1945621591.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1943279731.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1941775019.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1945389844.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1945168816.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1948893367.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1944518697.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946071110.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1944256581.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1948377867.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1944959541.0000000001053000.00000004.0
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\ source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.OC9oMrMV8] source: bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.OC9oMrMV8> source: bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ownload.error source: bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1941775019.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mi_exe_stub.pdb source: bZRL0uttVu.exe, 00000000.00000003.1930302255.000000000106F000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1930390191.0000000001082000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.OC9oMrMV8xxt2 source: bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1941775019.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorQ source: bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937966648.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936502164.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1937077054.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: bZRL0uttVu.exe, 00000000.00000003.1948145687.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931976210.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1965963769.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1966198899.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946286107.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1963497816.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1964883022.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946947383.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1956942295.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1949637001.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1966472682.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1936006544.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1951470561.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1962219875.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1944750528.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1963268673.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1939350381.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1964076160.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1946723113.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1931672595.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1965449997.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1947379445.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1938621556.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1962483111.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1962751919.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1964368306.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1949856514.0000000001053000.00000004.0
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.OC9oMrMV8 source: bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\OC9oMrMV8.README.txt source: bZRL0uttVu.exe, 00000000.00000003.1933453204.0000000001053000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.1932990902.0000000001053000.00000004.00000020.00020000.00000000.sdmp
PE file contains an invalid checksum
Source: bZRL0uttVu.exe Static PE information: real checksum: 0x31af1 should be: 0x2fdd7
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A356B push 0000006Ah; retf 0_2_005A3644
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A35D3 push 0000006Ah; retf 0_2_005A3644
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A35D5 push 0000006Ah; retf 0_2_005A3644
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A61EE push esp; retf 0_2_005A61F6
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Videos\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Searches\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Saved Games\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Recent\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Pictures\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Pictures\Saved Pictures\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Pictures\Camera Roll\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\OneDrive\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Music\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Links\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Favorites\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Favorites\Links\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Downloads\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\ZTGJILHXQB\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\ZGGKNSUKOP\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\WKXEWIOTXI\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\VAMYDFPUND\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\SUAVTZKNFL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\SQRKHNBNYN\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\SFPUSAFIOL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\QCFWYSKMHA\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\NVWZAPQSQL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\KLIZUSIQEN\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\IPKGELNTQY\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Documents\BJZFPPWAPT\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\ZTGJILHXQB\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\ZGGKNSUKOP\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\WKXEWIOTXI\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\VAMYDFPUND\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\SUAVTZKNFL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\SQRKHNBNYN\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\SFPUSAFIOL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\QCFWYSKMHA\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\NVWZAPQSQL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\KLIZUSIQEN\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\IPKGELNTQY\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Desktop\BJZFPPWAPT\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\Contacts\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Skype\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Skype\RootTools\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Headlights\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\d1702bdf-c0c8-42c3-b6d9-e52fd0a57b16\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\assets\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\VirtualStore\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Low\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrocef_low\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\SolidDocuments\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Publishers\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\PeerDistRepub\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e65614a4-2986-4163-aa7c-1a44d47f3a43}\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{59b571a3-bca9-49e1-9e72-2d4acd92de8f}\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\Temp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\TempState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\SystemAppData\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\RoamingState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalCache\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AppData\OC9oMrMV8.README.txt Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes itself after installation
Source: C:\ProgramData\B0BE.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B0BE.tmp >> NUL
Source: C:\ProgramData\B0BE.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B0BE.tmp >> NUL
May modify the system service descriptor table (often done to hook functions)
Source: download.error.OC9oMrMV80.0.dr Binary or memory string: KeServiceDescriptorTable
Contains functionality to clear windows event logs (to hide its activities)
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A91C8 RegCreateKeyExW,RegEnumKeyW,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,OpenEventLogW,ClearEventLogW,RegCreateKeyExW,RegEnumKeyW,OpenEventLogW,ClearEventLogW, 0_2_005A91C8
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\B0BE.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A10BC 0_2_005A10BC
Source: C:\ProgramData\B0BE.tmp Code function: 8_2_00401E28 8_2_00401E28
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: bZRL0uttVu.exe, 00000000.00000003.2041263022.0000000001082000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\WINDOWS KITS\10\DEBUGGERS\X86\WINDBG.EXE12392
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A10BC rdtsc 0_2_005A10BC
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A5C24 FindFirstFileW,FindClose,FindNextFileW,FindClose, 0_2_005A5C24
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AA094 FindFirstFileExW,FindClose, 0_2_005AA094
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A74BC FindFirstFileExW,FindNextFileW, 0_2_005A74BC
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A7590 FindFirstFileExW,FindClose, 0_2_005A7590
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A766C FindFirstFileExW,GetFileAttributesW,FindNextFileW, 0_2_005A766C
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AF308 GetFileAttributesW,SetThreadPriority,FindFirstFileExW,FindNextFileW,FindClose, 0_2_005AF308
Source: C:\ProgramData\B0BE.tmp Code function: 8_2_0040227C FindFirstFileExW, 8_2_0040227C
Source: C:\ProgramData\B0BE.tmp Code function: 8_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose, 8_2_0040152C
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005AA470 GetLogicalDriveStringsW, 0_2_005AA470
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\ Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Local\Temp\Diagnostics\ Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\ Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\ Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\ Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\ Jump to behavior
Source: bZRL0uttVu.exe, 00000000.00000003.2042301083.000000000105F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: *|turn windows features on or off*|hyper-v:wux:hyper-v4937
Source: bZRL0uttVu.exe, 00000000.00000003.2289460471.00000000010EA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/l>
Source: B0BE.tmp, 00000008.00000002.2543370445.0000000000654000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: bZRL0uttVu.exe, 00000000.00000003.2252997941.000000000118B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware20,1
Source: bZRL0uttVu.exe, 00000000.00000003.1927235172.00000000010E9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 10/04/2023 11:57:12.660OFFICECL (0x648)0x1fe0Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 20, "Time": "2023-10-04T10:57:11Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: bZRL0uttVu.exe, 00000000.00000003.2041263022.0000000001082000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware.View.Client12451
Source: bZRL0uttVu.exe, 00000000.00000003.2530988283.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2530360391.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, bZRL0uttVu.exe, 00000000.00000003.2520549903.00000000010EA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process information queried: ProcessInformation

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Thread information set: HideFromDebugger
Source: C:\ProgramData\B0BE.tmp Thread information set: HideFromDebugger
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A10BC rdtsc 0_2_005A10BC
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A5A20 LdrLoadDll, 0_2_005A5A20
Enables debug privileges
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Memory written: C:\ProgramData\B0BE.tmp base: 401000
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Process created: C:\ProgramData\B0BE.tmp "C:\ProgramData\B0BE.tmp"
Source: C:\ProgramData\B0BE.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B0BE.tmp >> NUL
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005A10BC cpuid 0_2_005A10BC
Contains functionality to query locales information (e.g. system language)
Source: C:\ProgramData\B0BE.tmp Code function: EntryPoint,ExitProcess,GetModuleHandleW,GetCommandLineW,GetModuleHandleA,GetCommandLineW,GetLocaleInfoW,GetLastError,FreeLibrary,FreeLibrary,GetProcAddress,CreateWindowExW,DefWindowProcW,GetWindowTextW,LoadMenuW,LoadMenuW,DefWindowProcW,SetTextColor,GetTextCharset,TextOutW,SetTextColor,GetTextColor,CreateFontW,GetTextColor,CreateDIBitmap,SelectObject,GetTextColor,CreateFontW, 8_2_00403983
Source: C:\Users\user\Desktop\bZRL0uttVu.exe Code function: 0_2_005B04B4 GetTempFileNameW,CreateFileW,WriteFile,CreateProcessW,NtQueryInformationProcess,NtReadVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,CreateNamedPipeW,ResumeThread,ConnectNamedPipe, 0_2_005B04B4

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Overwrites Mozilla Firefox settings
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\OC9oMrMV8.README.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\OC9oMrMV8.README.txt Jump to behavior

Stealing of Sensitive Information
barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857833.45e26519-596d-41a5-b290-e547b44111fd.health.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-update Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\events.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3f Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011f Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011f.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.81ddb4cc-1d49-45f2-961f-e24ea6db2be5.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9b Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\277ffbb3-8e94-4f3f-acac-7a401d130160.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8e.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54e Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fd.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666f.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3f.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fd Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54e.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8e Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\7d12ac42-15c3-4db9-abfe-259bc8d249ac Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9b.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9c Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857833.45e26519-596d-41a5-b290-e547b44111fd.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbc Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\7d12ac42-15c3-4db9-abfe-259bc8d249ac.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.81ddb4cc-1d49-45f2-961f-e24ea6db2be5.health.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\events Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666f Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-update.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9c.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbc.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\277ffbb3-8e94-4f3f-acac-7a401d130160 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite.OC9oMrMV8 Jump to behavior
Source: C:\Users\user\Desktop\bZRL0uttVu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4 Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1542685 Sample: bZRL0uttVu.exe Startdate: 26/10/2024 Architecture: WINDOWS Score: 100 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus / Scanner detection for submitted sample 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 6 other signatures 2->46 8 bZRL0uttVu.exe 32 1002 2->8         started        12 ONENOTE.EXE 2->12         started        process3 file4 24 {1AC14E77-02E7-4E5...7}_WF_msc.OC9oMrMV8, DOS 8->24 dropped 26 C:\...\Microsoft_Windows_Explorer.OC9oMrMV8, DOS 8->26 dropped 28 C:\Users\user\...\times.json.OC9oMrMV8, data 8->28 dropped 30 256 other files (252 malicious) 8->30 dropped 48 Found potential ransomware demand text 8->48 50 Found Tor onion address 8->50 52 Contains functionality to detect hardware virtualization (CPUID execution measurement) 8->52 54 8 other signatures 8->54 14 B0BE.tmp 8->14         started        18 splwow64.exe 8->18         started        signatures5 process6 file7 32 C:\Users\user\Desktop\bZRL0uttVu.exe, SysEx 14->32 dropped 34 C:\Users\user\Desktop\ZZZZZZZZZZZZZZ (copy), SysEx 14->34 dropped 36 C:\Users\user\Desktop\YYYYYYYYYYYYYY (copy), SysEx 14->36 dropped 38 24 other malicious files 14->38 dropped 56 Contains functionality to detect hardware virtualization (CPUID execution measurement) 14->56 58 Writes many files with high entropy 14->58 60 Hides threads from debuggers 14->60 62 Deletes itself after installation 14->62 20 cmd.exe 14->20         started        signatures8 process9 process10 22 conhost.exe 20->22         started       
⊘No contacted IP infos