Windows Analysis Report
9D7RwuJrth.exe

Overview

General Information

Sample name: 9D7RwuJrth.exe
renamed because original name is a hash value
Original sample name: 0ad0b4a4a549230e090d712b5521bd96.exe
Analysis ID: 1542977
MD5: 0ad0b4a4a549230e090d712b5521bd96
SHA1: 55690e0d976955e80f14c314efcaa34e3303a02b
SHA256: 9882ee185d8d4db2a86040b7e3c7687cef737470f2a7b5c88868e80880cbd429
Tags: DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected DCRat
Yara detected PureLog Stealer
Yara detected zgRAT
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Drops PE files with benign system names
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Files With System Process Name In Unsuspected Locations
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Stores large binary data to the registry
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 9D7RwuJrth.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe Avira: detection malicious, Label: TR/AVI.Agent.hjtmb
Source: C:\Users\user\AppData\Local\Temp\9O9rrJCHDg.bat Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Program Files (x86)\Windows Defender\en-GB\qLBhpsNtheWbwIdhOeZ.exe Avira: detection malicious, Label: TR/AVI.Agent.hjtmb
Source: C:\Users\user\AppData\Local\Temp\FYUTXnTyLD.bat Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\AppData\Local\Temp\BLXo76X4ph.bat Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\AppData\Local\Temp\yRPxJCkWkW.bat Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Program Files (x86)\Windows Defender\en-GB\qLBhpsNtheWbwIdhOeZ.exe Avira: detection malicious, Label: TR/AVI.Agent.hjtmb
Source: C:\Users\user\AppData\Local\Temp\KvMN3vAFGm.bat Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\Desktop\CvcPWQun.log Avira: detection malicious, Label: HEUR/AGEN.1362695
Source: C:\Users\user\Desktop\AEgOhmic.log Avira: detection malicious, Label: TR/Agent.jbwuj
Source: C:\Users\user\AppData\Local\Temp\g6UJbp2Exv.bat Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\Desktop\BRrXbneT.log Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\Desktop\COJNZQhv.log Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\AppData\Local\Temp\grDS520PRI.bat Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\Desktop\ANxQZOiH.log Avira: detection malicious, Label: TR/Agent.jbwuj
Source: C:\Program Files (x86)\Windows Defender\en-GB\qLBhpsNtheWbwIdhOeZ.exe Avira: detection malicious, Label: TR/AVI.Agent.hjtmb
Source: C:\Users\user\Desktop\CDLiAAVt.log Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\user\AppData\Local\Temp\gA6Kj9AC8z.bat Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\AppData\Local\Temp\x3fbj0yJ9Y.bat Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\AppData\Local\Temp\BBca1gliPd.bat Avira: detection malicious, Label: BAT/Delbat.C
Found malware configuration
Source: 00000000.00000002.1768667398.0000000012A61000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: DCRat {"C2 url": "http://304773cm.n9shteam.in/jscpuGamegeneratorprivate", "MUTEX": "DCR_MUTEX-ZEseCL54QGPnsao3t7iD"}
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe ReversingLabs: Detection: 65%
Source: C:\Program Files (x86)\Windows Defender\en-GB\qLBhpsNtheWbwIdhOeZ.exe ReversingLabs: Detection: 65%
Source: C:\Program Files\Windows Media Player\en-GB\qLBhpsNtheWbwIdhOeZ.exe ReversingLabs: Detection: 65%
Source: C:\Users\Default\OneDrive\qLBhpsNtheWbwIdhOeZ.exe ReversingLabs: Detection: 65%
Source: C:\Users\user\Desktop\AEgOhmic.log ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\ANxQZOiH.log ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\AVufnTwx.log ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\BwryKsoE.log ReversingLabs: Detection: 23%
Source: C:\Users\user\Desktop\CDLiAAVt.log ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\DpMeoAtV.log ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\GQJohFLp.log ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\KMHfZCnD.log ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\KrawoXqF.log ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\LALnLPjB.log ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\MFWOLyZB.log ReversingLabs: Detection: 23%
Source: C:\Users\user\Desktop\NZNelUXb.log ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\OPbwNHKO.log ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\QfjBlGMR.log ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\QnTUQpnW.log ReversingLabs: Detection: 23%
Source: C:\Users\user\Desktop\RngMDvMV.log ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\SFRmUDLH.log ReversingLabs: Detection: 23%
Source: C:\Users\user\Desktop\STgXZIan.log ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\TMiCdAAw.log ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\TcjfiIuK.log ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\TideCjWs.log ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\VNPvpVFD.log ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\XgJlfaRK.log ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\YiicOEwG.log ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\YrKlkCVM.log ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\ZELbGgFk.log ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\ZRpBnocC.log ReversingLabs: Detection: 23%
Source: C:\Users\user\Desktop\ZWwCXoEW.log ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\aOwTdXyg.log ReversingLabs: Detection: 29%
Multi AV Scanner detection for submitted file
Source: 9D7RwuJrth.exe ReversingLabs: Detection: 65%
Source: 9D7RwuJrth.exe Virustotal: Detection: 73% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Defender\en-GB\qLBhpsNtheWbwIdhOeZ.exe Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\BjyqpIYV.log Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Defender\en-GB\qLBhpsNtheWbwIdhOeZ.exe Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\CvcPWQun.log Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Defender\en-GB\qLBhpsNtheWbwIdhOeZ.exe Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\CDLiAAVt.log Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\CJLfMmRu.log Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 9D7RwuJrth.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: 9D7RwuJrth.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Directory created: C:\Program Files\Windows Media Player\en-GB\qLBhpsNtheWbwIdhOeZ.exe Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Directory created: C:\Program Files\Windows Media Player\en-GB\6661cc8d955995 Jump to behavior
Source: 9D7RwuJrth.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: .Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: WmiPrvSE.exe, 00000020.00000002.2377306205.000000001C937000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: WmiPrvSE.exe, 0000000E.00000002.2080168939.000000001C333000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb)) source: WmiPrvSE.exe, 00000020.00000002.2377306205.000000001C937000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: WmiPrvSE.exe, 00000005.00000002.1883557439.000000001B05E000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 0000000E.00000002.2078316070.000000001C240000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000026.00000002.2476107167.000000001BB50000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 0000002D.00000002.2610951731.000000001CCD6000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000033.00000002.2678331499.0000000000B97000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000039.00000002.2976792819.000000001B7AA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Parse Translate Aliases.pdb source: WmiPrvSE.exe, 00000005.00000002.1885289399.000000001BFB0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbI#` source: WmiPrvSE.exe, 0000000E.00000002.2080168939.000000001C333000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ws\GameBarPresenceWriter\WmiPrvSE.PDB N source: WmiPrvSE.exe, 00000020.00000002.2373276367.000000001C86F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: *rlib.pdb=R source: WmiPrvSE.exe, 00000005.00000002.1886057893.000000001C072000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File opened: C:\Users\user\AppData\Local Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49737 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49752 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49738 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49739 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49730 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49883 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49807 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49958 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50017 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50015 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50019 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50020 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50011 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50010 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50012 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50016 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50021 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50018 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50022 -> 188.114.96.3:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50013 -> 188.114.96.3:80
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 304773cm.n9shteam.inContent-Length: 336Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 304773cm.n9shteam.inContent-Length: 332Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: 304773cm.n9shteam.in
Source: unknown HTTP traffic detected: POST /jscpuGamegeneratorprivate.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 304773cm.n9shteam.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: WmiPrvSE.exe, 00000014.00000002.2091819764.000000000389D000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000020.00000002.2318062172.0000000003781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://304773cm.n9P
Source: WmiPrvSE.exe, 0000000E.00000002.1990818410.0000000003958000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000039.00000002.2793451795.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://304773cm.n9Pb
Source: WmiPrvSE.exe, 0000000E.00000002.1990818410.0000000003958000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000014.00000002.2091819764.000000000389D000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000020.00000002.2318062172.0000000003781000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000039.00000002.2793451795.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://304773cm.n9sh
Source: WmiPrvSE.exe, 00000005.00000002.1857861483.0000000002DA2000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000005.00000002.1857861483.0000000002F67000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000000E.00000002.1990818410.000000000340F000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000000E.00000002.1990818410.0000000003958000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000000E.00000002.1990818410.0000000003B35000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000014.00000002.2091819764.0000000003A60000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000014.00000002.2091819764.000000000389D000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000014.00000002.2091819764.000000000335B000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000001A.00000002.2184474475.00000000032CF000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000001A.00000002.2184474475.000000000310B000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000020.00000002.2318062172.000000000393A000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000020.00000002.2318062172.0000000003291000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000020.00000002.2318062172.0000000003781000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000026.00000002.2417043578.00000000038DA000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000026.00000002.2417043578.0000000003A88000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000002D.00000002.2549744196.0000000003924000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000002D.00000002.2549744196.0000000003AE8000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000033.00000002.2684878777.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000033.00000002.2684878777.0000000003191000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000039.00000002.2793451795.0000000003D7E000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000039.00000002.2793451795.00000000036B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://304773cm.n9shteam.in
Source: WmiPrvSE.exe, 00000039.00000002.2793451795.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://304773cm.n9shteam.in/
Source: WmiPrvSE.exe, 00000005.00000002.1857861483.0000000002DA2000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000000E.00000002.1990818410.000000000340F000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000000E.00000002.1990818410.0000000003958000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000014.00000002.2091819764.000000000389D000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000001A.00000002.2248061737.000000001B4D0000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 0000001A.00000002.2184474475.000000000310B000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000020.00000002.2318062172.0000000003291000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000020.00000002.2318062172.0000000003781000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000026.00000002.2417043578.00000000038DA000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000002D.00000002.2549744196.0000000003924000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000033.00000002.2684878777.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000039.00000002.2793451795.00000000036B1000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000039.00000002.2793451795.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://304773cm.n9shteam.in/jscpuGamegeneratorprivate.php
Source: WmiPrvSE.exe, 00000014.00000002.2091819764.000000000335B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://304773cm.n9shteam.in/jscpuGamegeneratorprivate.php0
Source: 9D7RwuJrth.exe, 00000000.00000002.1765297804.00000000030D6000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000005.00000002.1857861483.0000000002DA2000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000000E.00000002.1990818410.000000000340F000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000000E.00000002.1990818410.0000000003958000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000014.00000002.2091819764.000000000389D000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000014.00000002.2091819764.000000000335B000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000001A.00000002.2184474475.000000000310B000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000020.00000002.2318062172.0000000003291000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000020.00000002.2318062172.0000000003781000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000026.00000002.2417043578.00000000038DA000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 0000002D.00000002.2549744196.0000000003924000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000033.00000002.2684878777.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000039.00000002.2793451795.00000000036B1000.00000004.00000800.00020000.00000000.sdmp, WmiPrvSE.exe, 00000039.00000002.2793451795.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Creates files inside the system directory
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe\:Zone.Identifier:$DATA Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Windows\GameBarPresenceWriter\24dbde2999530e Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe File created: C:\Windows\system32\wbem\Performance\WmiApRpl_new.h
Source: C:\Windows\System32\wbem\WMIADAP.exe File created: C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini
Source: C:\Windows\System32\wbem\WMIADAP.exe File created: C:\Windows\inf\WmiApRpl\
Source: C:\Windows\System32\wbem\WMIADAP.exe File created: C:\Windows\inf\WmiApRpl\WmiApRpl.h
Source: C:\Windows\System32\wbem\WMIADAP.exe File created: C:\Windows\inf\WmiApRpl\WmiApRpl.ini
Source: C:\Windows\System32\wbem\WMIADAP.exe File created: C:\Windows\inf\WmiApRpl\0009\
Source: C:\Windows\System32\wbem\WMIADAP.exe File created: C:\Windows\system32\PerfStringBackup.TMP
Deletes files inside the Windows folder
Source: C:\Windows\System32\wbem\WMIADAP.exe File deleted: C:\Windows\System32\wbem\Performance\WmiApRpl.h
Detected potential crypto function
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Code function: 0_2_00007FFD9B880D70 0_2_00007FFD9B880D70
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Code function: 0_2_00007FFD9BFD3140 0_2_00007FFD9BFD3140
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Code function: 0_2_00007FFD9BFD0B14 0_2_00007FFD9BFD0B14
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 5_2_00007FFD9B8A0D70 5_2_00007FFD9B8A0D70
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 5_2_00007FFD9BFF506F 5_2_00007FFD9BFF506F
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 5_2_00007FFD9BFF0B14 5_2_00007FFD9BFF0B14
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 14_2_00007FFD9BAB0D70 14_2_00007FFD9BAB0D70
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 14_2_00007FFD9C20CD32 14_2_00007FFD9C20CD32
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 14_2_00007FFD9C20BF86 14_2_00007FFD9C20BF86
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 20_2_00007FFD9BAC0D70 20_2_00007FFD9BAC0D70
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 20_2_00007FFD9C21506F 20_2_00007FFD9C21506F
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 20_2_00007FFD9C21CD32 20_2_00007FFD9C21CD32
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 20_2_00007FFD9C21BF86 20_2_00007FFD9C21BF86
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 20_2_00007FFD9C226902 20_2_00007FFD9C226902
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BAC0866 26_2_00007FFD9BAC0866
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BAE0F31 26_2_00007FFD9BAE0F31
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BAEEFC8 26_2_00007FFD9BAEEFC8
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BAB0D70 26_2_00007FFD9BAB0D70
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9C200B14 26_2_00007FFD9C200B14
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 32_2_00007FFD9BAD0866 32_2_00007FFD9BAD0866
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 32_2_00007FFD9BAF0F31 32_2_00007FFD9BAF0F31
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 32_2_00007FFD9BAFEFC8 32_2_00007FFD9BAFEFC8
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 32_2_00007FFD9BAC0D70 32_2_00007FFD9BAC0D70
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 32_2_00007FFD9C21CD32 32_2_00007FFD9C21CD32
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 32_2_00007FFD9C21BF86 32_2_00007FFD9C21BF86
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 32_2_00007FFD9C21506F 32_2_00007FFD9C21506F
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 32_2_00007FFD9C22B2E4 32_2_00007FFD9C22B2E4
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 32_2_00007FFD9C226902 32_2_00007FFD9C226902
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\Desktop\AEgOhmic.log 80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
Sample file is different than original file name gathered from version info
Source: 9D7RwuJrth.exe, 00000000.00000002.1782132391.000000001BACB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Ex vs 9D7RwuJrth.exe
Source: 9D7RwuJrth.exe, 00000000.00000000.1727163824.0000000000412000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 9D7RwuJrth.exe
Source: 9D7RwuJrth.exe Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 9D7RwuJrth.exe
Uses 32bit PE files
Source: 9D7RwuJrth.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: 9D7RwuJrth.exe, Kf91xH5eoCMEdE3HBXl.cs Cryptographic APIs: 'CreateDecryptor'
Source: 9D7RwuJrth.exe, Kf91xH5eoCMEdE3HBXl.cs Cryptographic APIs: 'CreateDecryptor'
Source: 9D7RwuJrth.exe, Kf91xH5eoCMEdE3HBXl.cs Cryptographic APIs: 'CreateDecryptor'
Source: 9D7RwuJrth.exe, Kf91xH5eoCMEdE3HBXl.cs Cryptographic APIs: 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.evad.winEXE@90/227@1/1
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Program Files\Windows Media Player\en-GB\qLBhpsNtheWbwIdhOeZ.exe Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\gxIrOcDq.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5284:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8020:120:WilError_03
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:772:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2364:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-ZEseCL54QGPnsao3t7iD
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5984:120:WilError_03
Source: C:\Windows\System32\wbem\WMIADAP.exe Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex
Source: C:\Windows\System32\wbem\WMIADAP.exe Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Flag
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8140:120:WilError_03
Source: C:\Windows\System32\wbem\WMIADAP.exe Mutant created: \BaseNamedObjects\Global\ADAP_WMI_ENTRY
Source: C:\Windows\System32\wbem\WMIADAP.exe Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Lib
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2312:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3612:120:WilError_03
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\AppData\Local\Temp\rN7wUyQB6L Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gA6Kj9AC8z.bat"
Source: 9D7RwuJrth.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 9D7RwuJrth.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Windows\System32\cmd.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 9D7RwuJrth.exe ReversingLabs: Detection: 65%
Source: 9D7RwuJrth.exe Virustotal: Detection: 73%
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File read: C:\Users\user\Desktop\9D7RwuJrth.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\9D7RwuJrth.exe "C:\Users\user\Desktop\9D7RwuJrth.exe"
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gA6Kj9AC8z.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\yRPxJCkWkW.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\g6UJbp2Exv.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\grDS520PRI.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FYUTXnTyLD.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\KvMN3vAFGm.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\x3fbj0yJ9Y.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\wbem\WMIADAP.exe wmiadap.exe /F /T /R
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\9O9rrJCHDg.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\BBca1gliPd.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\BLXo76X4ph.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gA6Kj9AC8z.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe" Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\yRPxJCkWkW.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe" Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\g6UJbp2Exv.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\grDS520PRI.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FYUTXnTyLD.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\KvMN3vAFGm.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\x3fbj0yJ9Y.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\9O9rrJCHDg.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\BBca1gliPd.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\BLXo76X4ph.bat"
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\w32tm.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\w32tm.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\System32\w32tm.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\w32tm.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\w32tm.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\System32\w32tm.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\w32tm.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\w32tm.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\w32tm.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\w32tm.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mscoree.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: uxtheme.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.storage.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wldp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: profapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptsp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rsaenh.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptbase.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sspicli.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ktmw32.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: amsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iphlpapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dnsapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winnsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasapi32.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasman.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rtutils.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mswsock.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winhttp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasadhlp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: propsys.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: apphelp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dlnashext.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wpdshext.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: edputil.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: urlmon.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iertutil.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: srvcli.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: netutils.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wintypes.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: appresolver.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: bcp47langs.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: slc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sppc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mscoree.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: uxtheme.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.storage.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wldp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: profapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptsp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rsaenh.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptbase.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sspicli.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ktmw32.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iphlpapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dnsapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winnsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasapi32.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasman.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rtutils.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mswsock.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winhttp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasadhlp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: propsys.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: apphelp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dlnashext.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wpdshext.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: edputil.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: urlmon.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iertutil.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: srvcli.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: netutils.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wintypes.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: appresolver.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: bcp47langs.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: slc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sppc.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\PING.EXE Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE Section loaded: winnsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mscoree.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: uxtheme.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.storage.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wldp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: profapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptsp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rsaenh.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptbase.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sspicli.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ktmw32.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: amsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iphlpapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dnsapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winnsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasapi32.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasman.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rtutils.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mswsock.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winhttp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasadhlp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: propsys.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: apphelp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dlnashext.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wpdshext.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: edputil.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: urlmon.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iertutil.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: srvcli.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: netutils.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wintypes.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: appresolver.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: bcp47langs.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: slc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sppc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mscoree.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: uxtheme.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.storage.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wldp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: profapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptsp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rsaenh.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptbase.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sspicli.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ktmw32.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: amsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iphlpapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dnsapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winnsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasapi32.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasman.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rtutils.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mswsock.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winhttp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasadhlp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: propsys.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: apphelp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dlnashext.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wpdshext.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: edputil.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: urlmon.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iertutil.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: srvcli.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: netutils.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wintypes.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: appresolver.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: bcp47langs.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: slc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sppc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\PING.EXE Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE Section loaded: winnsi.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe Section loaded: loadperf.dll
Source: C:\Windows\System32\wbem\WMIADAP.exe Section loaded: ntmarta.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mscoree.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: uxtheme.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.storage.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wldp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: profapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptsp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rsaenh.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptbase.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sspicli.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ktmw32.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: amsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iphlpapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dnsapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winnsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasapi32.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasman.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rtutils.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mswsock.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winhttp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasadhlp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: propsys.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: apphelp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dlnashext.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wpdshext.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: edputil.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: urlmon.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iertutil.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: srvcli.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: netutils.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wintypes.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: appresolver.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: bcp47langs.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: slc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sppc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\PING.EXE Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE Section loaded: winnsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mscoree.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: uxtheme.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.storage.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wldp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: profapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptsp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rsaenh.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: cryptbase.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: sspicli.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ktmw32.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: amsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iphlpapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dnsapi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winnsi.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasapi32.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasman.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rtutils.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: mswsock.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: winhttp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: rasadhlp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: propsys.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: apphelp.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: dlnashext.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wpdshext.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: edputil.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: urlmon.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: iertutil.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: srvcli.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: netutils.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: wintypes.dll
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe File written: C:\Windows\System32\wbem\Performance\WmiApRpl_new.ini
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Directory created: C:\Program Files\Windows Media Player\en-GB\qLBhpsNtheWbwIdhOeZ.exe Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Directory created: C:\Program Files\Windows Media Player\en-GB\6661cc8d955995 Jump to behavior
Source: 9D7RwuJrth.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 9D7RwuJrth.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: 9D7RwuJrth.exe Static file information: File size 3408384 > 1048576
Source: 9D7RwuJrth.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x33fa00
Source: 9D7RwuJrth.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: .Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: WmiPrvSE.exe, 00000020.00000002.2377306205.000000001C937000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: WmiPrvSE.exe, 0000000E.00000002.2080168939.000000001C333000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb)) source: WmiPrvSE.exe, 00000020.00000002.2377306205.000000001C937000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: WmiPrvSE.exe, 00000005.00000002.1883557439.000000001B05E000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 0000000E.00000002.2078316070.000000001C240000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000026.00000002.2476107167.000000001BB50000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 0000002D.00000002.2610951731.000000001CCD6000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000033.00000002.2678331499.0000000000B97000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000039.00000002.2976792819.000000001B7AA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Parse Translate Aliases.pdb source: WmiPrvSE.exe, 00000005.00000002.1885289399.000000001BFB0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbI#` source: WmiPrvSE.exe, 0000000E.00000002.2080168939.000000001C333000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ws\GameBarPresenceWriter\WmiPrvSE.PDB N source: WmiPrvSE.exe, 00000020.00000002.2373276367.000000001C86F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: *rlib.pdb=R source: WmiPrvSE.exe, 00000005.00000002.1886057893.000000001C072000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 9D7RwuJrth.exe, Kf91xH5eoCMEdE3HBXl.cs .Net Code: Type.GetTypeFromHandle(SSdXZnuGqnkO9uEoek7.JbcqLjl6QPn(16777424)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(SSdXZnuGqnkO9uEoek7.JbcqLjl6QPn(16777245)),Type.GetTypeFromHandle(SSdXZnuGqnkO9uEoek7.JbcqLjl6QPn(16777259))})
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Code function: 0_2_00007FFD9B8847B1 pushad ; iretd 0_2_00007FFD9B8847B7
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Code function: 0_2_00007FFD9B8853C2 push edx; ret 0_2_00007FFD9B8853C5
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Code function: 0_2_00007FFD9B9E2561 push ecx; iretd 0_2_00007FFD9B9E2562
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Code function: 0_2_00007FFD9B9E5865 push es; retf 0_2_00007FFD9B9E5866
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Code function: 0_2_00007FFD9BC40C59 push ebx; ret 0_2_00007FFD9BC40C6A
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Code function: 0_2_00007FFD9BC40BD9 push ebx; ret 0_2_00007FFD9BC40BEA
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Code function: 0_2_00007FFD9BC40D8D push ebp; ret 0_2_00007FFD9BC40D8E
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Code function: 0_2_00007FFD9BC40CFC push esp; ret 0_2_00007FFD9BC40CFD
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Code function: 0_2_00007FFD9BC40C95 push ebp; ret 0_2_00007FFD9BC40CAA
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 5_2_00007FFD9B8A47B1 pushad ; iretd 5_2_00007FFD9B8A47B7
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 5_2_00007FFD9B8A53C2 push edx; ret 5_2_00007FFD9B8A53C5
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 5_2_00007FFD9BA02561 push ecx; iretd 5_2_00007FFD9BA02562
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 5_2_00007FFD9BA05865 push es; retf 5_2_00007FFD9BA05866
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 5_2_00007FFD9BFF3C03 push cs; retf 5_2_00007FFD9BFF3C05
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 14_2_00007FFD9BAB53C2 push edx; ret 14_2_00007FFD9BAB53C5
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 14_2_00007FFD9BAB47B1 pushad ; iretd 14_2_00007FFD9BAB47B7
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 20_2_00007FFD9BAC53C2 push edx; ret 20_2_00007FFD9BAC53C5
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 20_2_00007FFD9BAC47B1 pushad ; iretd 20_2_00007FFD9BAC47B7
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BAC8C54 push esi; iretd 26_2_00007FFD9BAC8C59
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BAC5C26 push esi; iretd 26_2_00007FFD9BAC5C27
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BAE419C push edx; retf 26_2_00007FFD9BAE593B
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BAE592B push edx; retf 26_2_00007FFD9BAE593B
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BAEC538 push edi; ret 26_2_00007FFD9BAEC5A6
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BAB53C2 push edx; ret 26_2_00007FFD9BAB53C5
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BAB47B1 pushad ; iretd 26_2_00007FFD9BAB47B7
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BAD433A push ebp; iretd 26_2_00007FFD9BAD4358
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BC12561 push ecx; iretd 26_2_00007FFD9BC12562
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9BC15865 push es; retf 26_2_00007FFD9BC15866
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9C205895 pushad ; ret 26_2_00007FFD9C205896
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9C20585E pushad ; ret 26_2_00007FFD9C20585F
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Code function: 26_2_00007FFD9C2058DA pushad ; ret 26_2_00007FFD9C2058DB
Source: 9D7RwuJrth.exe, oDRaHcqttXo2GhxBIid.cs High entropy of concatenated method names: 'tFiqaG5riD', 'Ar7qNIa7Zu', 'KFTIe07dO6BuJSXR8oJj', 'AQOarl7dk9A3CGOrf10x', 'uXT8Z57dxd6NlgnJELVk', 'j7PqhXiS2s', 'xlRLDt7dN0GhvW6dkqwt', 'dd3Fhc7dEyMuFJJSB1vh', 'Y74Loa7dowVg3wEK42le', 'dhhk5f7daKQBbvdGN7Ij'
Source: 9D7RwuJrth.exe, RaAj14QMXkPUG9hZ7FK.cs High entropy of concatenated method names: 'sDanCI7xaQvQjNGuWnGr', 'jiUTQN7xFI37VGprx0pa', 'hYkAdW7xoOvnxpwtn1ta', 'SSgGDGSckG', 'u0FHkM7xU9DPZGvrdUYm', 'YMHqX67xEWKORSGycVyt', 'WN8hd97xVKGjtyj8J4TG', 'q83tsd7xhDZ5VyH982DW', 'OyDm6d7xcZP46o7h1gRH', 'VkZ37Mmfh3'
Source: 9D7RwuJrth.exe, InUuEtki7f66nxvXPuj.cs High entropy of concatenated method names: 'Dispose', 'MoveNext', 'get_Current', 'Reset', 'get_Current', 'GetEnumerator', 'GetEnumerator', 'T9tDv07p0Md6hTfY3VaR', 'T1tl1S7pRUvk4u7claZB', 'wcFaWE7p8WA2RFWFyFj0'
Source: 9D7RwuJrth.exe, UKF3tvLKSSQsELl8cQf.cs High entropy of concatenated method names: 'DytLsErTA0', 'NeNLuGyABq', 'CJlLDKGtJM', 'y7tLzrxc0W', 'vCbC99GUCK', 'fwbC7F8uiV', 'WAGCqKbHes', 'twu3wP7n3ZChVgZuvWl1', 'HeVP807nj3y38T8O47kd', 'LoHM0I7nyI9uLKX3YjPD'
Source: 9D7RwuJrth.exe, SbWsqP28Yc34Xow1cyP.cs High entropy of concatenated method names: 'iDO2Mr9ys9', 'PPoD6f7lE58cpgoohQWe', 'VHfAew7lVIuXrm5munw6', 'am6W8E7lUjkYxSFExB56', 'dIDxop7lh15hZmQJIYfh', 'H4nae67laf3Y3k80ka4k', 'VWcXbR7lNcevGwYDKP0P'
Source: 9D7RwuJrth.exe, drvULy0S1cfKKta1rZk.cs High entropy of concatenated method names: 'oqA72PSt1fN', 'les0K3uy9X', 'lNK72eDseNN', 'Q3R8hp7a6CQJfW1pMh0V', 'SY2BQM7a1tpgwyK0Lm0q', 'ms8ang7aM3enVMYyYVUc', 'oy37qs7aIvNlHfCFooen', 'K7a8F77aWykm3N56vtG4', 'zqq0Jx7adwbMRecryL42', 'Qw6cC47aXs7peH0SOVuw'
Source: 9D7RwuJrth.exe, gjd9gX6MGPw85XjhCRs.cs High entropy of concatenated method names: 'Isr66NOOXW', 'YSI61wfqch', 'qJj6WkWkqE', 'oyw6ddLBtv', 'dLh6XOiY4l', 'U4J60g7Vf6oED8x4CC60', 'KLjYsh7Vc1aZeJdR7jAd', 'JFblJy7VSV01j7G6eNlK', 'oj7UMI7VKiByEF73Xsv3', 'km2yRo7VpVaNQuXjWEVC'
Source: 9D7RwuJrth.exe, qhRDuPIEj8OQwjbdJRy.cs High entropy of concatenated method names: 'a99', 'yzL', 'method_0', 'method_1', 'x77', 'sdJIU9reUG', 'DQKIh2Ctq0', 'Dispose', 'D31', 'wNK'
Source: 9D7RwuJrth.exe, xpLLWxCaD029CiwpvcL.cs High entropy of concatenated method names: 'ws0CgoXHmu', 'leLC5ZIl5G', 'AVdCsFUyLa', 'T2BAWP7JCqptvsAXEJen', 'J87nPr7J4eDeBdSp2nek', 'KtJ2AE7JLflsVihMvQVl', 'GpoRT67JbOGAOLuuJr35', 'TYdCEXeEHl', 'nqxCVvA9QF', 'S2HCUYn4Xp'
Source: 9D7RwuJrth.exe, Kf91xH5eoCMEdE3HBXl.cs High entropy of concatenated method names: 'CdrWDX7sKsUQIxX76lbr', 'AlgJut7spTQf5mB524jY', 'ciHswYrSNF', 'k9An1p7s5VcTRrAjfJ4D', 'gbeuPy7ssD8OkLo1dO1C', 'RSIp3c7su8n65jWYu6wd', 'N0UoKi7sD4faydG3c79A', 'mdKrtO7szscQ4H7qR6rQ', 'Eve9PT7u95wMaonOjoGu', 'MEailr7u7wwKne3So35a'
Source: 9D7RwuJrth.exe, UTTdM4F56WROA0D4ZLR.cs High entropy of concatenated method names: 'CjXFuYTXJM', 'A3OFDDUlhH', 'C3tFzVG0qq', 'JO7o9Cm9Fo', 'Bpyo7gjOO9', 'pFeoq4KKkI', 'Fu5oTM6Um0', 'UNKo47iaBr', 'Ib7oL6g6jd', 'MmcoCBftMs'
Source: 9D7RwuJrth.exe, anQ86Xmw0MJpVEbITbp.cs High entropy of concatenated method names: 'm1I', 'G4q', 'w29', 'Be072yl4jLT', 'Qdr74ULLCMc', 'XQfskm7omr2aq9xiD6To', 'CmLd137o0mrgp6hDYgCk', 'ATSHCF7oRQCw3gu9layx', 'ik4xRC7o8dKEU739C3Ll', 'Vp1hyR7or62M5qkIx2nM'
Source: 9D7RwuJrth.exe, k01UmvAVyjR0gVOdLFn.cs High entropy of concatenated method names: 'iVqAhiqvsy', 'v8EAcfRnPa', 'H1WAS80Qec', 'pYiAfEYIOK', 'kFgAKmytow', 'd0crt17SOcGUVBOATBqH', 'M47lU67SFY62vyXlYiwV', 'YhyVIL7SofAUgiSa2NdG', 'dmqra87SkSniVQG6VdbZ', 'ctSd9p7SxCFjCaT3lOpN'
Source: 9D7RwuJrth.exe, njuTe91tBuGBeZStDLw.cs High entropy of concatenated method names: 'method_0', 'kL51Jar7kS', 'jyL1lkthVy', 'Jiu1iaNHsB', 'NC31k6n02N', 'jsV1xoicpp', 'hnH1On2Fb4', 'xbfQTM7UG74TFPD6IqZj', 'pkMx5g7U3a6tNhqxL5jx', 'cBFeJa7UjI7twQnPDndC'
Source: 9D7RwuJrth.exe, W7PGLAClpiEOFs8TmXn.cs High entropy of concatenated method names: 'P83', 'KZ3', 'TH7', 'imethod_0', 'vmethod_0', 'ysF72H0QqNT', 'LGc747LGLGo', 'Pc16tj7nVCXnqFhIlORa', 'M3Jvyn7nUCIZHsnc5DA9', 'jbixyb7nhhDJMGWZ7yRh'
Source: 9D7RwuJrth.exe, EHbwWX59PsqrZOH7AyG.cs High entropy of concatenated method names: 'WPi54ZRQXu', 'pyG5LgZhdi', 'rwxZM57sdqlkupTZOWD6', 'CfDXCn7sXoDZ81EL42aj', 'Nl44qc7s1a5s6ejCTSN3', 'IxYhdy7sWMikt4MUXhdo', 'pbJWal7sAtm0hKHuh8jm', 'pqIZBt7stIbCujRMK71T', 's2A5qxcxAZ', 'wEY0Jv7srVboMf5UuyCp'
Source: 9D7RwuJrth.exe, KBZBiLqfh6mft0q2COo.cs High entropy of concatenated method names: 'RG6TbVBwCs', 'dh336P7dzdeUI5RwmFdU', 'fwA6xQ7X9EBi0HJlgsdm', 'AtPIVC7X721X5P0m80hr', 'uF2wLU7XqFf6qyJqyPsa', 'wL3L7e7duCd4SVBjQgvA', 'EC6pgm7dDEvFsEwILCeD', 'rHaMad7XTrP7jmc3Bd8F', 'fw5T9nAMW4', 'zbaTqSrnWF'
Source: 9D7RwuJrth.exe, al77XBLE6MX4lq6ZbCY.cs High entropy of concatenated method names: 'UZhLSYG9Nx', 'cS5ubN7nq58ytIwHLZrB', 'KxRI5j7nTAniNQA1VJ5a', 'CrXufb7n4Yb1c7dj6xiu', 'w01gC67nLLpw0Al6OQUk', 'U1J', 'P9X', 'D9774joXlpw', 'rSL74Phv8k9', 'btt72blUkLY'
Source: 9D7RwuJrth.exe, JtZZY1XoxmmpiE9PuOT.cs High entropy of concatenated method names: 'kCYXNHgowZ', 'ECCXEfUCQA', 'D4eXVInad0', 'xQbXUOjyr7', 'udrXhgNVwF', 'mXbXcU3bU4', 'Hp5XSG4yuD', 'nDPXfEQ1vr', 'HG9XKH4REO', 'aiUXp77Pcv'
Source: 9D7RwuJrth.exe, SZ51ujMH4gh69O5wV9n.cs High entropy of concatenated method names: 'D0gMt7NaC9', 'hAcMBrGUMP', 'XRyMy2nNoZ', 'wYwMGoZOuD', 'zN3M3Q2tcH', 'kYBMj3cTGR', 'IwNMPG1oAJ', 'hjxMeENXKV', 'GNhMY3CULT', 'HQVMmm9ycg'
Source: 9D7RwuJrth.exe, Hynb8Z7Gs2iQlRwb48c.cs High entropy of concatenated method names: 'fIu7jhFv0K', 'LSF7PACdUo', 'l0l7ehOMpM', 'r6SKlM7W0YjYfx4yq4sX', 'vgHRVB7WYbPNODyCtDxX', 'Cg6KbR7WmCTUuQWyHhLO', 'TVRVf07WR8NNIVfXw1jh', 'wKswGg7W8GdDKIr8qJwG', 'H6v3pv7Wr7QhFAwO2K3o'
Source: 9D7RwuJrth.exe, y5l0ZeOVv2Ry1fjaaxm.cs High entropy of concatenated method names: 'mJ772IqZYfJ', 'GtOOhI8Igl', 'Ce0OcVcRbt', 'ub8OSLqKWI', 'cYxx1v7wGOevmGwyfl9h', 'ygJ13X7w3pughN7fS9jP', 'PBhfQe7wjxAY6pGvsGd9', 'uKSytv7wP649kW8WLF2j', 'PIGxMC7we8rt7O1kZ7dQ', 'VbwiP27wY9qfEddfkxDY'
Source: 9D7RwuJrth.exe, s5S2BWT1mOW6JbYohtv.cs High entropy of concatenated method names: 'cvVTNbpYMY', 'PiTTETlanP', 'tkOTVbuLuu', 'xwv83E7XUo9Hxx6ZCZ8M', 'qxYhgl7XhcmLljuVJNQZ', 'VAE2P77XEy8txfjp3J6Z', 'VqNgn47XVPg26kwV4409', 'cXsTdi1e3K', 'lkQTXGHlRm', 'uqqTANTpTM'
Source: 9D7RwuJrth.exe, uB0MamgtLJk9nkvBLKQ.cs High entropy of concatenated method names: 'pQSgJpIyU7', 'TeaglwsVvK', 'tO8gi0mJRp', 'DTfgkd90kI', 'Dispose', 'wrZAAB75zppNchSVYIwv', 'MRUx437s9nZdXoKkRi2u', 'eWBNhi7s7ZhIlkTkvfoB', 'dgJMJW7sq4f1h1wXUvbC', 'Wnc0QW7sTVlbcBVJsyE5'
Source: 9D7RwuJrth.exe, xReAprdpsdYoi4qcXsD.cs High entropy of concatenated method names: 'RfJdvM4Yc5', 'r5AdgqC9Lm', 'jPWd5vhw60', 'l5HdsOf7Q6', 'H6bduqmWoV', 'dFiuRr7hNAJwfxgYhjLG', 'KXEa7K7hEGlms5TgUIvn', 'GpQ2337hVqNXmt3qDANA', 'TFbsN37hUH1qdEE76x4b', 'vpJfKr7hhhtqBCp8oawr'
Source: 9D7RwuJrth.exe, lPhCVPWTBXxTjl5eFnb.cs High entropy of concatenated method names: 'method_0', 'YU8', 'method_1', 'method_2', 'CmoWLD1Or2', 'Write', 'OQ9WC4Bt7X', 'wOQWbpHIAP', 'Flush', 'vl7'
Source: 9D7RwuJrth.exe, qyldEDJfeZKUBhcexWx.cs High entropy of concatenated method names: 'OJ2Jpjf2XB', 'k6r', 'ueK', 'QH3', 'QjPJwGqByP', 'Flush', 'PlBJvSM9ah', 'e5JJgnVEZV', 'Write', 'ttbJ5ojwRB'
Source: 9D7RwuJrth.exe, RmYdWV4nhws6ZiMUBNk.cs High entropy of concatenated method names: 'KZ3', 'imethod_0', 'vmethod_0', 'uYE7249VBt9', 'LGc747LGLGo', 'Kj2vuV7Ai385XkcusBhP', 'dTlWIB7AkZVCZd5q5FV2', 'vIrDye7AxgVfx9EvWUsb', 'LHJFR17AOHbRk7Pt0Yds', 'yH6ZD87AFtk2ayQZUvr6'
Source: 9D7RwuJrth.exe, a9uBubmd9paahNPlP9E.cs High entropy of concatenated method names: 'vkqmkwg7r8', 'QcrKe77o759pk4Lte0ta', 'twasyM7FzeL0bDeDHkNJ', 'nKaYNX7o9yaT31hQ9vwp', 'TYkyOy7oq0xNenpXIE79', 'DOHmA8GkxL', 'rhumtMs84y', 'tugmnBoqb2', 'ayKT1S7FsPDSd2SpwNsq', 'XKa9F17FgdZVrbcImYKx'
Source: 9D7RwuJrth.exe, qil0lEdDCqJTnlfbfOl.cs High entropy of concatenated method names: 'sl4X96bc0k', 'EJeX75k7bh', 'FUQXqqY4LC', 'SWNXTOJ75l', 'HyhX450krC', 'lQVXLDNnw9', 'yR0Bn97hwuhiXWtBkbKV', 'MgXkSd7hKK8HxUc80q9o', 'OTCn007hpNcxy8iZ0yHJ', 'hSnUm77hvaC9RsF2REGU'
Source: 9D7RwuJrth.exe, Ys7FTlWaLOPH7Yd9LHR.cs High entropy of concatenated method names: 'TYGWukPTNv', 'CEJWzX5gyE', 'VyaWERNhpA', 'acDWV7TO4O', 'xQJWUEYO0R', 'CJEWhAo63e', 'syPWcp5yLT', 'HadWSxG9gI', 'CoYWfJDJb7', 'lWRWKnLHjC'
Source: 9D7RwuJrth.exe, orFB3JzXKx8JTss06L.cs High entropy of concatenated method names: 'Xlb77JixZ3', 'EDK7T7fcRp', 'C7674EY1Lq', 'XKJ7LI8M40', 'NsB7C6YScr', 'iRF7bIPmtM', 'aXS7QIgVxG', 'ByVj4y7WHM4nQE3ZURBP', 'kawa2i7WZ2I57nql2BSu', 'DiaoSa7WB2c3i34S1G4J'
Source: 9D7RwuJrth.exe, PbMNL3wxUlg7eTC62nW.cs High entropy of concatenated method names: 'gpx721EpVOW', 'PL57C64k62V', 'ylEh6I7gKRr0rKY3HTIv', 'Wq7et57gScb5w8RvEpkj', 'zCCNoo7gfKBcLOngUiMq', 'qOZ9VU7gpiilaGwQgikq', 'C6uWd67g56I4raqNgo6C', 'u9f4k77gv8KPGxY3veK5', 'guP6IV7ggAU8KfgbcJOO', 'mBcdeA7gs3ktHT9WahMQ'
Source: 9D7RwuJrth.exe, dJA0w9t2Q1GyTPWLo3c.cs High entropy of concatenated method names: 'B0MtHLh3S2', 'noGtZ6CuY6', 'method_0', 'method_1', 'I27', 'c6a', 'C5p', 'o8YtBrgse4', 'method_2', 'uc7'
Source: 9D7RwuJrth.exe, jN9uYrQGLDqCJTaJkUr.cs High entropy of concatenated method names: 'q76', 'method_0', 'p9e', 'hkB', 'method_1', 'method_2', 'gKTHfK7iF43Ij92LN3Xu', 'vO14mF7ioOyiY2YgFLNg', 'DRHiR07iasGuAAaujye7', 'KKyJ7Y7iN97vwPyxLr7L'
Source: 9D7RwuJrth.exe, ETELfIOtjB5vEW7KKMb.cs High entropy of concatenated method names: 'BfuOJ8XaF2', 'gSWOlVPKt0', 'HnYOiBpnp9', 'KuAOkTRGNn', 'aFnOxmoJTk', 'SfJOOBhncB', 'UxTOFel6Uh', 'sHDOoEEu8k', 'usjOaJPcrF', 'NN6ONglqAr'
Source: 9D7RwuJrth.exe, Bp932glfIliCvt5qYAr.cs High entropy of concatenated method names: 'BvBZkm7KuQIaq9nxXnGy', 's0ogcb7K5o5NnEuwLPup', 'wG7nS37KsXZR5LlnEEHG', 'L5D0w77KD3pYIjFdAdn7', 'RaelpSZilw', 'Mh9', 'method_0', 'd9clw0L2AE', 'AsWlvLXA90', 'J3Klg24Zq0'
Source: 9D7RwuJrth.exe, hqeaiKTfj8XMsYbw0XD.cs High entropy of concatenated method names: 'Yhk4TfMdi0', 'bYE44gp3Ab', 'uUQ4LN5fBA', 'P3WIyx7ALWPRwWFkXrZV', 'CmWUQy7ACOFBbwtWtvqI', 'mpPmp47AT0OoixXBGisA', 'cKu8fD7A46HTUZCK1HjD', 'l1i4ZBNLiv', 'qw0hIC7AHKbL7SrrM3Xt', 'ds7OhN7A2OfimoUnv4RG'
Source: 9D7RwuJrth.exe, T7VNMkADoG6p7I03w69.cs High entropy of concatenated method names: 'FHGt9fUIus', 'h3Tt7MUGsj', 'Yd7', 'XBitqgYf5s', 'DCJtT1me6I', 'yEyt4JgJpO', 'RKRtLq18ob', 'BjXSEZ7SS1wl44FiiIqh', 'hIDW527SfxRnRS4GIoM0', 'DUpyQY7SKSmhH8yuyMBG'
Source: 9D7RwuJrth.exe, bJEKfk0G06Vne29gi37.cs High entropy of concatenated method names: 'qv700oobgI', 't7I8iI7owqvBjvdEcbMQ', 'W0YH227ovanT9GAxJ4TY', 'T6UOFH7oK8dO2AISG7PC', 'NsUgGJ7opYIIYoVQmxxo', 'S9hiBb7og0pYWdi2hpT0', 'cwK0jFNkMC', 'TCFNXq7oEtRhtQJxPirQ', 'oJKq7j7oVPchg5Sw4pgg', 'iT5pF37oUduPrQ8VBV49'
Source: 9D7RwuJrth.exe, jphCFHbtC6HDk22rCS4.cs High entropy of concatenated method names: 'QvXbJ4cdM0', 'C5WblSXXm6', 'QrfR4h7JwIS8mwXeJSmi', 'dCCWbg7JKp2ZYHDhRohr', 'BTkUps7JpSN04fAq7GxO', 'K3Zy8j7JvyA8hvoixAsu', 'CMrmQQ7JgHHdFK36FF0d', 'Gulqdd7J5ptZJNxcoPyu', 'qJOPZT7JsnghKNOPD1fo', 'htA3pM7JuSvHksJTAxLy'
Source: 9D7RwuJrth.exe, b2752hOQWlZFvCj9ovC.cs High entropy of concatenated method names: 'auYOIRZ4eG', 'QOQpoa7w9xCCluEgYrUe', 'XZAc667pDXWZRkevusQs', 'UvtydV7pzsR4gr7Vk6HT', 'GL3jIx7w7jVPYhkhIyjR', 'VTAiaq7wqdTNupl5wi54', 'IPy', 'method_0', 'method_1', 'method_2'
Source: 9D7RwuJrth.exe, Q8hQXXbksfM0tZIjpyK.cs High entropy of concatenated method names: 'P9X', 'vmethod_0', 'lFq74MbHdf6', 's8372Z6UqDf', 'imethod_0', 'xdBCII7l7vn1DjkhdXcv', 'GUsqSH7JzgM8i4G32xRm', 'dCCY5a7l9ugBTCIWrfPZ', 'TMqCmQ7lqD6Ym5wrYRgY', 'eXVlKM7lTZ08siO8aKiH'
Source: 9D7RwuJrth.exe, Nb4skt4FotxhAxbVCcB.cs High entropy of concatenated method names: 'K2u4u9GD2V', 'PINL0a7tCph4StqBsvTp', 'BBIbBh7tb8gkyrBQPbcJ', 'tKuwGC7t4GBMQjZrPTCv', 'Ec8iOG7tLCC5KwhbgIA6', 'G8hyfi7tQRyrJDKhrFw3', 'f5ZNeT7tHDlJo4jJmN5O', 'x07LCjKLvb', 'KeQ2777tGFb4GMpbVmDp', 'IgggA87tBD8GUaXiSZjD'
Source: 9D7RwuJrth.exe, krkLV6bmP3s4LPHH98q.cs High entropy of concatenated method names: 'HdQbdIse9p', 'qtbZQU7JUpsuk4dWyhRR', 'R67XO57JhnE7nvGcnvMn', 'DgepDb7JEni2hYiBQcTt', 'tRXe167JVKKfxtk2y0qM', 'T3MJTc7Jc5yBjVZycEp3', 'wgQo057JSU87BeuakPmL', 'YoWbRNkba6', 'pCnb8wS74I', 'LFEbrlLeqr'
Source: 9D7RwuJrth.exe, wumMPpmOT2SGDRGb3mL.cs High entropy of concatenated method names: 'vFNmUGbCA4', 'qfomh3PZwn', 'n50mc18nIC', 'vEy2np7oZUpAT772PWOs', 'K41fPs7oBSJJBvFNN893', 'g1y2ds7oQP3pMw0cSOZj', 'ykWZE57oHaa1CJerMgeK', 'MyRmocZUWp', 'pofmagydIU', 'jbBmNPFCJl'
Source: 9D7RwuJrth.exe, VhxqrbuFeo8aPFZOSWl.cs High entropy of concatenated method names: 'cpf7CnV2OFk', 'D557CJxpC7B', 'JyV7ClWElo1', 'Fqf7CiZ5eRo', 'sfn7CkjnkP0', 'ytx7CxclLwx', 'BeX7CORYsmb', 'kWkDLQIoZa', 'foN7CFSvkEb', 'X1V7Co9jvFK'
Source: 9D7RwuJrth.exe, CFFe8gQqkfVPL27tei7.cs High entropy of concatenated method names: 'KDnQ4Bajr4', 'B6bQLnChGe', 'eQaQCBqZEt', 'd7hQbnGKpy', 'VqUQ2BoH6y', 'YboQQMWgJ9', 'sZrQHposWY', 'RRTQZ171y4', 'zKHQBTR2yS', 'RRuQy9ayHV'
Source: 9D7RwuJrth.exe, udYiN5nRk01noMkjSh0.cs High entropy of concatenated method names: 'rGgJGLlip2', 'dRmoAY7fVd4fVRr3GVs6', 'VJcT0t7fNOXDFKAcLjMX', 'l7SU8K7fE04aqd6L6LCI', 'ByS1oS7fUYkPBeEA7hWx', 'kt5', 'Q1SnrkpygU', 'ReadByte', 'get_CanRead', 'get_CanSeek'
Source: 9D7RwuJrth.exe, xHHWssLjtLM5HDyYro6.cs High entropy of concatenated method names: 'X3eLWyFeVm', 'VLeLdirOvE', 'On7LXco6KN', 'ljZQLP7tFIIJ6q9wLjFX', 'z84sXh7toNAwHdBkMEah', 'hKfLMVlOoF', 'NZELI9FYtb', 'DFtHjd7tknxybuHlBFmS', 'qH8JA57txhLeA0XMbQbl', 'MK4Dsh7tl1DmQIBUiTOM'
Source: 9D7RwuJrth.exe, GjEnXyMKLa4vNBC1o3j.cs High entropy of concatenated method names: 'DiFMwRgD0C', 'mLqMvfnbMk', 'qSAMgGdeVm', 'GQqM5sZ1OX', 'FMLMsfvd7L', 'z3lXk47EvxXBAAYwEjF2', 'WCwYBN7EpASglbDmkTTg', 'LM2BAq7EwrTaoroN5Md2', 'bkxfCR7EgPXgP6IO8tLa', 'YGOerx7E53fD1qMUyZpF'
Source: 9D7RwuJrth.exe, XkslydbQ5qbReFkJwFB.cs High entropy of concatenated method names: 'Lc6bZ5gGhq', 'B0BbBJubR1', 'mThE317JmDVEOVTf9F1H', 'xdfHTM7JeCe0rOYSLY4Y', 'JgoswD7JYO7hvJVRRR6k', 'fDH5H47J0t4Zi36SDYke', 'yya9UG7JROGg9gXvBMnN', 'jQq4yx7J8SXPH3osNFxn', 'Df9ltm7JrMn0XiZJ0FBG'
Source: 9D7RwuJrth.exe, yhIixf2PTXCmMxPFKj5.cs High entropy of concatenated method names: 'L2Z20aA4q2', 'XH0kXd7lO6suG8WnNg0Y', 'p7yGc57lkkjbGnu1VwGi', 'biwnHB7lxLow5hadit6t', 'gVM2wt7lFoEWd0JcTe7S', 'bOc2Yy4e6K', 'llFUM57lJPtlgEVEfJHJ', 'Wqd21Z7ltHjfkm05sBR5', 'igGYCu7lnlnPOeGtXo3M', 'c5sGuI7llUI0oWDTQZcp'
Source: 9D7RwuJrth.exe, RJTGxX46rJ1duYg4E8M.cs High entropy of concatenated method names: 'VZq', 'KZ3', 'XA4', 'imethod_0', 'e23', 'u0w72TVWm3v', 'LGc747LGLGo', 'Gi8HqK7A19uNFtVCcdcX', 'VfpVXr7AWHkDyhClBNyP', 'XljCJX7AdhfKCPFCav6q'
Source: 9D7RwuJrth.exe, yGIN4Z7DchOOk5g1ZHh.cs High entropy of concatenated method names: 'KZ3', 'fW4', 'imethod_0', 'U7v', 'jU0727axoL0', 'LGc747LGLGo', 'aPrJDL7d93PKDdoDrfTa', 'D0dD8g7d7XhoyaSHVxAO', 'vbuZhm7dq2tUhmGPGIPC', 'OgCfnb7dTtYgfNVsHI0E'
Source: 9D7RwuJrth.exe, l8XmwgqLRUwXJuooeBh.cs High entropy of concatenated method names: 'd55qbjiTmY', 'DxGq2D6SR8', 'GqVqQuF33o', 'b8bqH3s0R9', 'I5T5jV7d3lHVJSXCla8T', 'fYhfHj7dywePg2AsMhWc', 'r56tpK7dGKvXptJXV37k', 'MvAxv47djseSSNsjgq7X', 'JFXxas7dPVBtUKcEsxi0', 'V38bru7de0FtLVWQfwKu'
Source: 9D7RwuJrth.exe, hVNNmV3rJ7hE1neC3ad.cs High entropy of concatenated method names: 'NFXmyfSsKS', 'PFEmGUhKNH', 'q8tEIf7FaKkymGG5ulMw', 'vVVXSl7FF0nR7L0vTEr5', 'Psu6mF7FodrIqo8umu88', 'QkuYO27FNry9DK46yNW5', 'OtQLod7FEasAD6u09LWR', 'hsfmmYgXot', 'yiqBWD7FcUy3gsgM2cQ5', 'SqgdmP7FUTjT1N6C9TK3'
Source: 9D7RwuJrth.exe, id8trMwt1C8muCcnUi0.cs High entropy of concatenated method names: 'method_0', 'h59', 'R73', 'GGGwJ9aflX', 'g6xr5k7gmSAcWONATCwS', 'd4AI147g0fGtMjILq6Zf', 'R3ywE17gRJKNGLHjOcQO', 'OHpOTQ7g87uo68ioyrfH', 'qRRMlp7grTWZPdACGDye', 'JHokIJ7gM08pcZLbvGJG'
Source: 9D7RwuJrth.exe, Po1l4J8ydxJsrZv1w8J.cs High entropy of concatenated method names: 'r1cM7nCMlb', 'edB4pU7E64GiLXTccNJ6', 'WkmLnD7EMmLGnLr2umsu', 'yLg21X7EInjTOK3YRy55', 'M3eh5n7E1oqQVYYIRvHA', 'yrW83yJL6K', 'lsT8jUv4vq', 'Nw28PaOH7k', 'FEH8egiJ6E', 'aCM8YwKkAJ'
Source: 9D7RwuJrth.exe, hPD8gXFtFFjovtNn204.cs High entropy of concatenated method names: 'jS3FJw0l98', 'rIfFlGP3uM', 'dsbFiC1nLj', 'D4JFks45R1', 'uK2FxG3kfD', 'VLVFO7nmyq', 'tCRFFp4OB6', 'ypiFo5Ho4q', 'X8VFae2rHb', 'R8cFNo2YA7'
Source: 9D7RwuJrth.exe, hKTSZNe530RPbETdA2.cs High entropy of concatenated method names: 'DpQltDQUg', 'j3dhEG71JUFilSwfFpeY', 'OF2mRK71l5ZoKH1110IO', 'UsWABK71tyAfiervnSW3', 'cMUTeD71ngccwNHfhehx', 'GH7mpIAOJ', 'zMJ0pI4Kq', 'WveRGNbpY', 'Enc8dCbTi', 'GkUrsOk5e'
Source: 9D7RwuJrth.exe, bsemlnbatBnoibwHoVd.cs High entropy of concatenated method names: 'kaNbgOtcHO', 'tFRb5MMnnD', 'v9HWOB7lHm4P63tT610j', 'od9cdl7lZGsvPxf1FhMW', 'qmiKIT7lBrBnZ9SPJiJU', 'cBZbEhoI9B', 'D2WbVlVPr4', 'MtnbU8t8gJ', 'q4mbhT2tkA', 'xJ7bco4kAg'
Source: 9D7RwuJrth.exe, LwsEa6uYwx7BwL7Dxjj.cs High entropy of concatenated method names: 'xHtuXKmDOh', 'RtSuAZBk53', 'stbuthKQa1', 'GI2unw1d4X', 'IP9uJ1LQ7W', 'kYxuljcxKl', 'ynOuiTAtoY', 'vb2ukt6t6b', 'VPiuxdlmd9', 'XDHuOaYopH'
Source: 9D7RwuJrth.exe, ou2jGV2WtuERulUdHUK.cs High entropy of concatenated method names: 'g8s2Xf1r6Y', 'WU32AfLNvq', 'XJU2tBOuof', 'Lhd2nKOVyT', 'hxq2JZGVKp', 'sKh2l5tTBn', 'oIPpv07lvQPTkWlsllGa', 'fjKNWP7lguMR48UOSy7i', 'UPHqWn7l5rV5P1bdkkpX', 'uTctAI7lsuuTew7aC6yH'
Source: 9D7RwuJrth.exe, Ly0aOF2HaCYt4VBjvLS.cs High entropy of concatenated method names: 'sN52BkQO47', 'r3X2yK2ugt', 'tYa2GvDMEh', 'rYHIs17lIrBLqujALCaD', 'IyKn397l65QaJ3HAXmY2', 'Ch7Rwq7lrmewRJpP6Qw5', 'jL20OY7lMk8ZSgkYLsNl', 'Kol9yg7l1234ncUxYCoE', 'c3y3q27lWVIRn6uJEfQ0', 'pZUbKq7ldIJNpvLSErZK'
Source: 9D7RwuJrth.exe, JDLyxaRjfbCNj5tGa7q.cs High entropy of concatenated method names: 'sbYFCx7NmAL5QTta5vRN', 'O11Zki7N0FQr0VQRtugC', 'N5HoOV7Ne96hWkRWw4n1', 'xBcgwL7NYM5uD7LhNRJN', 'method_0', 'method_1', 'bosRew2blg', 'YQwRYyIEJs', 'krWRmtvs3N', 'OsUR0XuK9N'
Source: 9D7RwuJrth.exe, xPDFM8gyIlVEH8qyHel.cs High entropy of concatenated method names: 'cNIgjBK6s6', 'iDRgmSZsGn', 'vTGg8BR0V9', 'FX2grxLo3Z', 'XfvgMSeVvK', 'SgZgIbcNrR', 'hbQg65NCll', 'v0Ug1AISFS', 'Dispose', 'Yy30Zg75pEQNs8EwSE2r'
Source: 9D7RwuJrth.exe, bWqvhkCIlWprXwWuSmG.cs High entropy of concatenated method names: 'DSeCtCfiTb', 'eOZ4Uc7no4NFw724kNk7', 'NjOyYk7nOrRqMU1lOO4A', 'tomeTc7nFJNfTDS9jBUG', 'oZ2yFn7na8JJDBApDug3', 'MrSvsw7nNmkiyAiUYN5O', 'E94', 'P9X', 'vmethod_0', 'zqV740wPF6X'
Source: 9D7RwuJrth.exe, oj0d00LFhbMWexGnIyD.cs High entropy of concatenated method names: 'q64', 'P9X', 'dk274G0vNnO', 'vmethod_0', 'gYr72C8gC0N', 'imethod_0', 'snoLub7tfwjsvj7QV3qc', 'QTmTlZ7tK551P8pB4lDh', 'RehTHN7tpTo10P5clI4B', 'CgmJ0K7tw0iE1QdonoMO'
Source: 9D7RwuJrth.exe, ikKtwGLQMK5arGTybLf.cs High entropy of concatenated method names: 'Rpx', 'KZ3', 'imethod_0', 'vmethod_0', 'bNm72LIMUnx', 'LGc747LGLGo', 'HoARso7tekAV6hrpLw5E', 'wRnVJI7tYOGZqwUFnFTD', 'Hdf4HB7tmynBFDIbvJoT', 'SwDQHF7t0XeKUvwDOG7x'
Source: 9D7RwuJrth.exe, vx8nOYb7BXmrY7rpWvR.cs High entropy of concatenated method names: 'w51bTjx4Go', 'ViEb46KydY', 'RfibLuc6Vi', 'YMbXQx7JQfElYfyHyWeJ', 'zHf0ND7JHXUFiViXj6rC', 'uwsOvl7JZ9cyE0wNoD5I', 'Mc4Kyk7JBlCOMmvurW8C', 'GiGN8T7JysUAY62aT6ac', 'BortHg7JGovo4T7ZlKs1', 'SJ9VV47J31dIxIJjeMQ7'
Source: 9D7RwuJrth.exe, CkFgc9LldtD6jVTopH2.cs High entropy of concatenated method names: 'l29', 'P9X', 'vmethod_0', 'YrQ74ZACZ7S', 'lwaLkaZOJZ', 'imethod_0', 'p5x0aq7tNOWBkIkRgb01', 'gYnOc07tEHixUxMeVSHC', 'NRsGQa7tVNjhKy0sI1HF', 'Y13o3G7tUyBSfReodmMu'
Source: 9D7RwuJrth.exe, xGBpRT2U9IROgndOioA.cs High entropy of concatenated method names: 'bLM2gHwryL', 'bNkEfZ7iGxjKDjkHMyJS', 'WX3Oas7iBxLlUTFZSdch', 'ndHhiB7iyRnHKRWDRHDy', 'Lt9bZ87i3BqywqPRy9jV', 'utmGL97ijS7lnge5C2Gm', 'P9X', 'vmethod_0', 'JSx74Wrj58Z', 'imethod_0'
Source: 9D7RwuJrth.exe, aNcrPDlxt3Os5kHufCN.cs High entropy of concatenated method names: 'q13', 'Sw1', 'method_0', 'nQFlFCTplI', 'c64lo06ynG', 'QDulaKhj30', 'DTilN700Dc', 'fhSlEsL7PI', 'jwYlVvhZFR', 'dyepRM7Kx4TXHBvgmHwm'

Persistence and Installation Behavior
barindex
Drops PE files with benign system names
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe Jump to dropped file
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Windows\System32\cmd.exe Executable created and started: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe
Drops PE files
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\haeBUeau.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\RfxtYLmQ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\XYaTBrrE.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\VNPvpVFD.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\MbDxwcVz.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\aOwTdXyg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\YqcMQKie.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\hdVuXvrH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\zuvWKvqh.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ywOZehbx.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\HiuOyNKb.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\xBgoYyEi.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\fkHAryTS.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\gmasiRfw.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\YvkCHKYH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\wvgrNMIh.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\fkGLlyFI.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\gqAKFZhr.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\RoOvQmlu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\CJLfMmRu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\TMiCdAAw.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\iayrzvUL.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\BjyqpIYV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\MsfvwPWb.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\zHFGLnTh.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\KebpbcGE.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\EvEoCbHu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\RngMDvMV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\GQJohFLp.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\jrYzshHe.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\HGufhKgM.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\zgMHUZTa.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\BwryKsoE.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\UAlWJNil.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\gxIrOcDq.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\oTbQbbYz.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\czckklIZ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\imHaAnxM.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\uILHvqzR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\TideCjWs.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\QfjBlGMR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\xJQGDhfo.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\IonNSomK.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\rrlpDagQ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\MPcmOdeg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\pdjZooeB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\kcQjpOfp.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\XujdOCGR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ZDFmwSFw.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\nzWIOABa.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\QJwUIRwB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\VfEmYjln.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\MFWOLyZB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\xtqXCEKK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\SFRmUDLH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\lkUrzNzM.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\cvCSNcGe.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\brYbblpC.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\DpMeoAtV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\gGCbQipO.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\lZsrLOuk.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\XOCTRFXH.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\QnTUQpnW.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\cItldMID.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\CvcPWQun.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\NhwwQEyh.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\bHyKcPKg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\yNVrtDVA.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\cLlTmcma.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\aghuugwS.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\dsdajcUY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\fnytvPjf.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\LsLFRydK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\tPKQwznS.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\BRrXbneT.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ijPsrWTp.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\rEFrcoVj.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\uMlYSzCN.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ZWwCXoEW.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\dVAarBMu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\rgoKfKUN.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\HENwTSHn.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\YrKlkCVM.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\sUsSQXQL.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\RUOvtANV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\NZNelUXb.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\XprDnjwZ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\OdqVYMoD.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\RXHdCRrs.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\tojirtOm.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\JpYWvPZP.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\OQhlWUKC.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\VBmvCWAb.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\COJNZQhv.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ZRpBnocC.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\infrqIKS.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\rMoKHXwo.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\smiIylww.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\rNXibPjW.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\qKWRQFlK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\IpLeIKzQ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\XgJlfaRK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\OLjDJquB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\GfifQgAx.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\kOAKeIBA.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\tLkzZqkX.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\KrawoXqF.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\xFRjkDBd.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ANxQZOiH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\QLdDWJUZ.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\YiicOEwG.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\vhcgKXhJ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\XQkCfxwg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\yWtgjqCG.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\kjAKCvZY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\nSHawKfi.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\HBUOKBdR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\sOOpvBpu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\QfdDtvsy.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\OPbwNHKO.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\quKhiaRV.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\jOdAThRi.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\kWkcJscF.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Program Files (x86)\Windows Defender\en-GB\qLBhpsNtheWbwIdhOeZ.exe Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\vVohbyWj.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\guQJELZU.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\JENuXwBf.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\oOOAVsVq.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\AVufnTwx.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\rAfaFgSo.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\SYsmfrex.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ZELbGgFk.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\TcjfiIuK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ITFobKbD.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\KSAetdQl.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\lHCBdANz.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\qQwaFPUc.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\JdPmuXvO.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\ZOCRVjRy.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\iEOtPIrO.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\seyqUCWq.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\jwQjNADO.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\KMHfZCnD.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\AddxSDXD.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\FDIxLbbR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\mUfaJIkR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\decjNzkA.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\gUkCADyL.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\CDLiAAVt.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\Hwddojgi.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ocsSTCYe.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\eJEjcPHs.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\HoTXnYtt.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\mRnsAsGv.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\STgXZIan.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\eoNbkqdw.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\wipYxcGI.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\AEgOhmic.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\eNYCHMrV.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\DCtffNkc.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\kChIFuMg.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Program Files\Windows Media Player\en-GB\qLBhpsNtheWbwIdhOeZ.exe Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\OzPMecrY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\niPqzeHY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\qpMzVwBT.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\OIrVAZQe.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\jFPSHRJE.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\hyUuvhPg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\yCtrFDQY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\JUqyElOI.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\Default\OneDrive\qLBhpsNtheWbwIdhOeZ.exe Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\bXhLAPqc.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\LALnLPjB.log Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\OzPMecrY.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\vhcgKXhJ.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\dVAarBMu.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\JENuXwBf.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\AVufnTwx.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\rrlpDagQ.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\jOdAThRi.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\gxIrOcDq.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\QnTUQpnW.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\eJEjcPHs.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\COJNZQhv.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\kChIFuMg.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\ZOCRVjRy.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\QfjBlGMR.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\AddxSDXD.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\quKhiaRV.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File created: C:\Users\user\Desktop\YiicOEwG.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\QJwUIRwB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\cvCSNcGe.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\TMiCdAAw.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\JdPmuXvO.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\zuvWKvqh.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\infrqIKS.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ZELbGgFk.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\OQhlWUKC.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\xJQGDhfo.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\dsdajcUY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\DCtffNkc.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\sOOpvBpu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\bHyKcPKg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\IpLeIKzQ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\xBgoYyEi.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\pdjZooeB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\guQJELZU.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\XOCTRFXH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ZRpBnocC.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\RngMDvMV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\HENwTSHn.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\yWtgjqCG.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\niPqzeHY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\XgJlfaRK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\MsfvwPWb.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\CJLfMmRu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\jrYzshHe.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\RfxtYLmQ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\Hwddojgi.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\qpMzVwBT.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\XYaTBrrE.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\GQJohFLp.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\wipYxcGI.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\nzWIOABa.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\OLjDJquB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\lkUrzNzM.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\iayrzvUL.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\SYsmfrex.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\JpYWvPZP.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\zHFGLnTh.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\oTbQbbYz.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\fkHAryTS.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\OdqVYMoD.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\DpMeoAtV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\czckklIZ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\LsLFRydK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\AEgOhmic.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\jwQjNADO.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\aOwTdXyg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\QfdDtvsy.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\HBUOKBdR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\decjNzkA.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\KSAetdQl.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\tLkzZqkX.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\kcQjpOfp.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\QLdDWJUZ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\xtqXCEKK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\gmasiRfw.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\MPcmOdeg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\uILHvqzR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\lZsrLOuk.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\brYbblpC.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\XujdOCGR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\haeBUeau.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\YrKlkCVM.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\OIrVAZQe.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\GfifQgAx.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\nSHawKfi.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\imHaAnxM.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\cLlTmcma.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\TideCjWs.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\RXHdCRrs.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\IonNSomK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\smiIylww.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\iEOtPIrO.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\XQkCfxwg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\FDIxLbbR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\vVohbyWj.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\eNYCHMrV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\VfEmYjln.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\KrawoXqF.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\seyqUCWq.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\bXhLAPqc.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\RoOvQmlu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\HGufhKgM.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\qQwaFPUc.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\BwryKsoE.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\rNXibPjW.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ijPsrWTp.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\YvkCHKYH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\HoTXnYtt.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ocsSTCYe.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\eoNbkqdw.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\NhwwQEyh.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\tPKQwznS.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\cItldMID.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\RUOvtANV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ANxQZOiH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\gqAKFZhr.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\NZNelUXb.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\EvEoCbHu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\uMlYSzCN.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\gGCbQipO.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\MFWOLyZB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\LALnLPjB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\BRrXbneT.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\tojirtOm.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\jFPSHRJE.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ZWwCXoEW.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\JUqyElOI.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\zgMHUZTa.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\gUkCADyL.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\YqcMQKie.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\wvgrNMIh.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\lHCBdANz.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\UAlWJNil.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\KMHfZCnD.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\BjyqpIYV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\rAfaFgSo.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ywOZehbx.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\SFRmUDLH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\CDLiAAVt.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\sUsSQXQL.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\qKWRQFlK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ZDFmwSFw.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\OPbwNHKO.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\yNVrtDVA.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\mUfaJIkR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\VNPvpVFD.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\CvcPWQun.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\kjAKCvZY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\TcjfiIuK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\HiuOyNKb.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\rgoKfKUN.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\hyUuvhPg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\fnytvPjf.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\kWkcJscF.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\kOAKeIBA.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\aghuugwS.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\KebpbcGE.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\ITFobKbD.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\rMoKHXwo.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\hdVuXvrH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\XprDnjwZ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\xFRjkDBd.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\mRnsAsGv.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\MbDxwcVz.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\rEFrcoVj.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\STgXZIan.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\yCtrFDQY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\oOOAVsVq.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\fkGLlyFI.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File created: C:\Users\user\Desktop\VBmvCWAb.log Jump to dropped file
Creates or modifies windows services
Source: C:\Windows\System32\wbem\WMIADAP.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl\Performance
Stores large binary data to the registry
Source: C:\Windows\System32\wbem\WMIADAP.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\PROVIDERS\Performance Performance Data
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIADAP.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIADAP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIADAP.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Windows\System32\cmd.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Uses ping.exe to sleep
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Memory allocated: C80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Memory allocated: 1AA60000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: A10000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 1A720000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 1520000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 1B0F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 1410000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 1B020000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: D40000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 1AA90000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 1120000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 1AF70000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 14B0000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 1B260000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 18A0000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 1B2C0000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: B20000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 1A970000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 1040000 memory reserve | memory write watch
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Memory allocated: 18D0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\wbem\WMIADAP.exe Window / User API: threadDelayed 2072
Source: C:\Windows\System32\wbem\WMIADAP.exe Window / User API: threadDelayed 1505
Source: C:\Windows\System32\wbem\WMIADAP.exe Window / User API: threadDelayed 1224
Source: C:\Windows\System32\wbem\WMIADAP.exe Window / User API: threadDelayed 1879
Source: C:\Windows\System32\wbem\WMIADAP.exe Window / User API: threadDelayed 1244
Found dropped PE file which has not been started or loaded
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\haeBUeau.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\RfxtYLmQ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\MbDxwcVz.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\XYaTBrrE.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\VNPvpVFD.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\aOwTdXyg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\hdVuXvrH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\YqcMQKie.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\zuvWKvqh.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\ywOZehbx.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\HiuOyNKb.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\gmasiRfw.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\wvgrNMIh.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\fkHAryTS.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\YvkCHKYH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\xBgoYyEi.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\fkGLlyFI.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\gqAKFZhr.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\RoOvQmlu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\CJLfMmRu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\TMiCdAAw.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iayrzvUL.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\BjyqpIYV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\MsfvwPWb.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\zHFGLnTh.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\KebpbcGE.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\EvEoCbHu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\RngMDvMV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\GQJohFLp.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\jrYzshHe.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\zgMHUZTa.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\HGufhKgM.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\BwryKsoE.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\UAlWJNil.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\czckklIZ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\oTbQbbYz.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\gxIrOcDq.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\imHaAnxM.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\uILHvqzR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\TideCjWs.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\QfjBlGMR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\IonNSomK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\xJQGDhfo.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\rrlpDagQ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\MPcmOdeg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\pdjZooeB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\kcQjpOfp.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\XujdOCGR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\ZDFmwSFw.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\nzWIOABa.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\QJwUIRwB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\MFWOLyZB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\VfEmYjln.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\xtqXCEKK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\SFRmUDLH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\lkUrzNzM.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\cvCSNcGe.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\brYbblpC.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\gGCbQipO.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\DpMeoAtV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\lZsrLOuk.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\XOCTRFXH.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\QnTUQpnW.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\cItldMID.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\CvcPWQun.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\NhwwQEyh.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\bHyKcPKg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\yNVrtDVA.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\aghuugwS.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\cLlTmcma.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\dsdajcUY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\fnytvPjf.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\LsLFRydK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\tPKQwznS.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\BRrXbneT.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\ijPsrWTp.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\rEFrcoVj.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\uMlYSzCN.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\ZWwCXoEW.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\dVAarBMu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\rgoKfKUN.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\HENwTSHn.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\sUsSQXQL.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\YrKlkCVM.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\RUOvtANV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\NZNelUXb.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\XprDnjwZ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\tojirtOm.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\OdqVYMoD.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\RXHdCRrs.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\JpYWvPZP.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\OQhlWUKC.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\VBmvCWAb.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\COJNZQhv.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\ZRpBnocC.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\infrqIKS.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\rMoKHXwo.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\smiIylww.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\rNXibPjW.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\qKWRQFlK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\IpLeIKzQ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\XgJlfaRK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\OLjDJquB.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\kOAKeIBA.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\GfifQgAx.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\tLkzZqkX.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\xFRjkDBd.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\KrawoXqF.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\ANxQZOiH.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\QLdDWJUZ.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\YiicOEwG.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\XQkCfxwg.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\vhcgKXhJ.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\yWtgjqCG.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\kjAKCvZY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\nSHawKfi.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\HBUOKBdR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\sOOpvBpu.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\QfdDtvsy.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\OPbwNHKO.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\jOdAThRi.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\quKhiaRV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\kWkcJscF.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\vVohbyWj.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\guQJELZU.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\JENuXwBf.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\oOOAVsVq.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\AVufnTwx.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\rAfaFgSo.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\SYsmfrex.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\ZELbGgFk.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\TcjfiIuK.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\ITFobKbD.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\KSAetdQl.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\lHCBdANz.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\qQwaFPUc.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\JdPmuXvO.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\ZOCRVjRy.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\seyqUCWq.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\iEOtPIrO.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\jwQjNADO.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\KMHfZCnD.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\AddxSDXD.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\mUfaJIkR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\FDIxLbbR.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\decjNzkA.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\gUkCADyL.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\CDLiAAVt.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Hwddojgi.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\ocsSTCYe.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\eJEjcPHs.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\HoTXnYtt.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\mRnsAsGv.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\STgXZIan.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\eoNbkqdw.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\wipYxcGI.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\AEgOhmic.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\eNYCHMrV.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\DCtffNkc.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\kChIFuMg.log Jump to dropped file
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Dropped PE file which has not been started: C:\Users\user\Desktop\OzPMecrY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\niPqzeHY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\qpMzVwBT.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\OIrVAZQe.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\hyUuvhPg.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\yCtrFDQY.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\jFPSHRJE.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\JUqyElOI.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\bXhLAPqc.log Jump to dropped file
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Dropped PE file which has not been started: C:\Users\user\Desktop\LALnLPjB.log Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\9D7RwuJrth.exe TID: 5628 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 4092 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 1928 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 7504 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 7440 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 7892 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 7760 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 5840 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 8128 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 7232 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 4444 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 6360 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 7560 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 1772 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 7924 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 8052 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 7876 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 5100 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe TID: 7956 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\System32\cmd.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\System32\cmd.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\System32\cmd.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\System32\cmd.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\PING.EXE Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: WmiPrvSE.exe, 00000020.00000002.2373276367.000000001C86F000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000033.00000002.2767742882.000000001BAA9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllH=u
Source: WmiPrvSE.exe, 00000039.00000002.2985135868.000000001C680000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: War&Prod_VMware_
Source: WmiPrvSE.exe, 00000014.00000002.2135913069.000000001BA10000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;
Source: WmiPrvSE.exe, 00000020.00000002.2373276367.000000001C8BC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: w32tm.exe, 00000025.00000002.2364180244.0000021E0F969000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2
Source: WmiPrvSE.exe, 00000005.00000002.1855922939.00000000008F2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlle
Source: WmiPrvSE.exe, 00000020.00000002.2377306205.000000001C93C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: WmiPrvSE.exe, 00000026.00000002.2480909854.000000001C437000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3:W;
Source: w32tm.exe, 00000038.00000002.2730116789.00000283BE0D7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK
Source: WmiPrvSE.exe, 0000001A.00000002.2248061737.000000001B4FD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlll
Source: w32tm.exe, 00000004.00000002.1815836551.0000015461707000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 0000000E.00000002.2075596491.000000001BA0D000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000013.00000002.2039099015.000001DCC15E7000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000019.00000002.2136654662.000001FCF56F9000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 0000002D.00000002.2605516166.000000001BBDD000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000039.00000002.2779088116.000000000113B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: qLBhpsNtheWbwIdhOeZ.exe0.0.dr Binary or memory string: sHivMcIRye
Source: WmiPrvSE.exe, 00000014.00000002.2140937679.000000001CAB9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process token adjusted: Debug
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process token adjusted: Debug
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process token adjusted: Debug
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process token adjusted: Debug
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process token adjusted: Debug
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process token adjusted: Debug
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gA6Kj9AC8z.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe" Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\yRPxJCkWkW.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe" Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\g6UJbp2Exv.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\grDS520PRI.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FYUTXnTyLD.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\KvMN3vAFGm.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\x3fbj0yJ9Y.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\9O9rrJCHDg.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\BBca1gliPd.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe "C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe"
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\BLXo76X4ph.bat"
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Queries volume information: C:\Users\user\Desktop\9D7RwuJrth.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe VolumeInformation Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe VolumeInformation Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\9D7RwuJrth.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: WmiPrvSE.exe, 0000000E.00000002.2075596491.000000001BA0D000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 0000000E.00000002.2078316070.000000001C268000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 0000000E.00000002.1987771230.0000000001286000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000014.00000002.2140937679.000000001CA44000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000020.00000002.2366104209.000000001B8A5000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000026.00000002.2480909854.000000001C3F0000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000026.00000002.2476107167.000000001BB9B000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 0000002D.00000002.2605516166.000000001BBDD000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000033.00000002.2757263786.000000001B295000.00000004.00000020.00020000.00000000.sdmp, WmiPrvSE.exe, 00000039.00000002.2976792819.000000001B6F0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\cmd.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\cmd.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information
barindex
Yara detected DCRat
Source: Yara match File source: 00000000.00000002.1768667398.0000000012A61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 9D7RwuJrth.exe PID: 3428, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WmiPrvSE.exe PID: 3720, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 9D7RwuJrth.exe, type: SAMPLE
Source: Yara match File source: 0.0.9D7RwuJrth.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1727163824.0000000000412000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe, type: DROPPED
Source: Yara match File source: C:\Program Files (x86)\Windows Defender\en-GB\qLBhpsNtheWbwIdhOeZ.exe, type: DROPPED
Source: Yara match File source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe, type: DROPPED
Yara detected zgRAT
Source: Yara match File source: 9D7RwuJrth.exe, type: SAMPLE
Source: Yara match File source: 0.0.9D7RwuJrth.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe, type: DROPPED
Source: Yara match File source: C:\Program Files (x86)\Windows Defender\en-GB\qLBhpsNtheWbwIdhOeZ.exe, type: DROPPED
Source: Yara match File source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe, type: DROPPED

Remote Access Functionality
barindex
Yara detected DCRat
Source: Yara match File source: 00000000.00000002.1768667398.0000000012A61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 9D7RwuJrth.exe PID: 3428, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: WmiPrvSE.exe PID: 3720, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 9D7RwuJrth.exe, type: SAMPLE
Source: Yara match File source: 0.0.9D7RwuJrth.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1727163824.0000000000412000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe, type: DROPPED
Source: Yara match File source: C:\Program Files (x86)\Windows Defender\en-GB\qLBhpsNtheWbwIdhOeZ.exe, type: DROPPED
Source: Yara match File source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe, type: DROPPED
Yara detected zgRAT
Source: Yara match File source: 9D7RwuJrth.exe, type: SAMPLE
Source: Yara match File source: 0.0.9D7RwuJrth.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe, type: DROPPED
Source: Yara match File source: C:\Program Files (x86)\Windows Defender\en-GB\qLBhpsNtheWbwIdhOeZ.exe, type: DROPPED
Source: Yara match File source: C:\Windows\GameBarPresenceWriter\WmiPrvSE.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1542977 Sample: 9D7RwuJrth.exe Startdate: 27/10/2024 Architecture: WINDOWS Score: 100 172 304773cm.n9shteam.in 2->172 180 Suricata IDS alerts for network traffic 2->180 182 Found malware configuration 2->182 184 Antivirus detection for dropped file 2->184 186 11 other signatures 2->186 15 9D7RwuJrth.exe 4 39 2->15         started        signatures3 process4 file5 164 C:\Windows\...\WmiPrvSE.exe, PE32 15->164 dropped 166 C:\Users\user\Desktop\vhcgKXhJ.log, PE32 15->166 dropped 168 C:\Users\user\Desktop\rrlpDagQ.log, PE32 15->168 dropped 170 24 other malicious files 15->170 dropped 176 Drops PE files with benign system names 15->176 19 cmd.exe 1 15->19         started        signatures6 process7 signatures8 188 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->188 190 Uses ping.exe to sleep 19->190 192 Uses ping.exe to check the status of other devices and networks 19->192 22 WmiPrvSE.exe 14 23 19->22         started        27 cmd.exe 19->27         started        29 w32tm.exe 1 19->29         started        31 2 other processes 19->31 process9 dnsIp10 174 304773cm.n9shteam.in 188.114.96.3, 49730, 49737, 49738 CLOUDFLARENETUS European Union 22->174 132 C:\Users\user\Desktop\zuvWKvqh.log, PE32 22->132 dropped 134 C:\Users\user\Desktop\xJQGDhfo.log, PE32 22->134 dropped 136 C:\Users\user\Desktop\xBgoYyEi.log, PE32 22->136 dropped 138 15 other malicious files 22->138 dropped 198 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 22->198 33 cmd.exe 1 22->33         started        36 WmiPrvSE.exe 27->36         started        39 conhost.exe 27->39         started        41 chcp.com 27->41         started        43 w32tm.exe 27->43         started        file11 signatures12 process13 file14 178 Uses ping.exe to sleep 33->178 45 WmiPrvSE.exe 22 33->45         started        48 conhost.exe 33->48         started        50 PING.EXE 1 33->50         started        52 chcp.com 1 33->52         started        108 C:\Users\user\Desktop\uMlYSzCN.log, PE32 36->108 dropped 110 C:\Users\user\Desktop\tPKQwznS.log, PE32 36->110 dropped 112 C:\Users\user\Desktop\rNXibPjW.log, PE32 36->112 dropped 114 15 other malicious files 36->114 dropped 54 cmd.exe 36->54         started        signatures15 process16 file17 140 C:\Users\user\Desktop\yWtgjqCG.log, PE32 45->140 dropped 142 C:\Users\user\Desktop\wipYxcGI.log, PE32 45->142 dropped 144 C:\Users\user\Desktop\qpMzVwBT.log, PE32 45->144 dropped 146 15 other malicious files 45->146 dropped 57 cmd.exe 45->57         started        59 WMIADAP.exe 45->59         started        194 Uses ping.exe to sleep 54->194 61 WmiPrvSE.exe 54->61         started        64 conhost.exe 54->64         started        66 chcp.com 54->66         started        68 PING.EXE 54->68         started        signatures18 process19 file20 70 WmiPrvSE.exe 57->70         started        73 conhost.exe 57->73         started        75 chcp.com 57->75         started        77 w32tm.exe 57->77         started        148 C:\Users\user\Desktop\zgMHUZTa.log, PE32 61->148 dropped 150 C:\Users\user\Desktop\wvgrNMIh.log, PE32 61->150 dropped 152 C:\Users\user\Desktop\tojirtOm.log, PE32 61->152 dropped 154 15 other malicious files 61->154 dropped 79 cmd.exe 61->79         started        process21 file22 124 C:\Users\user\Desktop\zHFGLnTh.log, PE32 70->124 dropped 126 C:\Users\user\Desktop\oTbQbbYz.log, PE32 70->126 dropped 128 C:\Users\user\Desktop\lkUrzNzM.log, PE32 70->128 dropped 130 15 other malicious files 70->130 dropped 82 cmd.exe 70->82         started        202 Uses ping.exe to sleep 79->202 84 WmiPrvSE.exe 79->84         started        87 conhost.exe 79->87         started        89 chcp.com 79->89         started        91 PING.EXE 79->91         started        signatures23 process24 file25 93 WmiPrvSE.exe 82->93         started        96 conhost.exe 82->96         started        98 chcp.com 82->98         started        100 w32tm.exe 82->100         started        116 C:\Users\user\Desktop\ywOZehbx.log, PE32 84->116 dropped 118 C:\Users\user\Desktop\yNVrtDVA.log, PE32 84->118 dropped 120 C:\Users\user\Desktop\sUsSQXQL.log, PE32 84->120 dropped 122 15 other malicious files 84->122 dropped 102 cmd.exe 84->102         started        process26 file27 156 C:\Users\user\Desktop\xtqXCEKK.log, PE32 93->156 dropped 158 C:\Users\user\Desktop\uILHvqzR.log, PE32 93->158 dropped 160 C:\Users\user\Desktop\tLkzZqkX.log, PE32 93->160 dropped 162 15 other malicious files 93->162 dropped 105 cmd.exe 93->105         started        196 Drops executables to the windows directory (C:\Windows) and starts them 102->196 signatures28 process29 signatures30 200 Uses ping.exe to sleep 105->200
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.114.96.3
 304773cm.n9shteam.in European Union
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
304773cm.n9shteam.in 188.114.96.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://304773cm.n9shteam.in/jscpuGamegeneratorprivate.php true unknown