Windows Analysis Report
9758xBqgE1azKnB.exe

Overview

General Information

Sample name: 9758xBqgE1azKnB.exe
Analysis ID: 1562040
MD5: bf7866489443a237806a4d3d5701cdf3
SHA1: ffbe2847590e876892b41585784b40144c224160
SHA256: 1070bf3c0f917624660bef57d24e6b2cf982dce067e95eb8a041586c0f41a095
Tags: exeuser-lontze7
Infos:

Detection

XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Protects its processes via BreakOnTermination flag
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Found malware configuration
Source: 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": ["18.181.154.24"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V3.1"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Virustotal: Detection: 54% Perma Link
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Virustotal: Detection: 54% Perma Link
Multi AV Scanner detection for submitted file
Source: 9758xBqgE1azKnB.exe ReversingLabs: Detection: 57%
Source: 9758xBqgE1azKnB.exe Virustotal: Detection: 54% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 9758xBqgE1azKnB.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack String decryptor: 18.181.154.24
Source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack String decryptor: 7000
Source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack String decryptor: <123456789>
Source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack String decryptor: <Xwormmm>
Source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack String decryptor: USB.exe
Uses 32bit PE files
Source: 9758xBqgE1azKnB.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 9758xBqgE1azKnB.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Windows\NHwE.pdbpdbHwE.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Xml.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Windows.Forms.pdbH source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\NHwE.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Accessibility.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.ni.pdbRSDS source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Core.pdbAccessibility.dll8 source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: \??\C:\Windows\exe\NHwE.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\exe\NHwE.pdbu source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Configuration.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.0000000001507000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Xml.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: o.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Xml.ni.pdbRSDS# source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: NHwE.pdbSHA256T source: 9758xBqgE1azKnB.exe, grjujyNaBLaKbU.exe.0.dr, 9758xBqgE1azKnB.exe.7.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Core.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: n0C:\Windows\mscorlib.pdbj~ source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: %%.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Windows.Forms.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdb% source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.000000000156C000.00000004.00000020.00020000.00000000.sdmp, WER1BE7.tmp.dmp.28.dr
Source: Binary string: NHwE.pdb source: 9758xBqgE1azKnB.exe, grjujyNaBLaKbU.exe.0.dr, 9758xBqgE1azKnB.exe.7.dr
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.000000000152A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbD source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Management.ni.pdbRSDSJ< source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Drawing.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Management.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: mscorlib.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Management.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: symbols\dll\mscorlib.pdbLb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\exe\NHwE.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WER1BE7.tmp.dmp.28.dr
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 4x nop then jmp 07854F3Ch 0_2_078547DE
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 4x nop then jmp 081B41CCh 8_2_081B3A6E
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 4x nop then jmp 073241CCh 14_2_07323A6E
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 4x nop then jmp 06CA41CCh 19_2_06CA3A6E

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 18.181.154.24:7000 -> 192.168.2.4:49735
Source: Network traffic Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 18.181.154.24:7000 -> 192.168.2.4:49735
Source: Network traffic Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49735 -> 18.181.154.24:7000
Source: Network traffic Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49735 -> 18.181.154.24:7000
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 18.181.154.24
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49735 -> 18.181.154.24:7000
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: unknown TCP traffic detected without corresponding DNS query: 18.181.154.24
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, grjujyNaBLaKbU.exe, 00000008.00000002.1747690067.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000013.00000002.1908285352.0000000002479000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 9758xBqgE1azKnB.exe, grjujyNaBLaKbU.exe.0.dr, 9758xBqgE1azKnB.exe.7.dr String found in binary or memory: http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources
Source: Amcache.hve.28.dr String found in binary or memory: http://upx.sf.net
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, XLogger.cs .Net Code: KeyboardLayout
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, XLogger.cs .Net Code: KeyboardLayout
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, XLogger.cs .Net Code: KeyboardLayout
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, XLogger.cs .Net Code: KeyboardLayout

Operating System Destruction
barindex
Protects its processes via BreakOnTermination flag
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: 01 00 00 00 Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000D.00000002.1753363260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000008.00000002.1747690067.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_0150D57C 0_2_0150D57C
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_078562C8 0_2_078562C8
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_07851D18 0_2_07851D18
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_07850478 0_2_07850478
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_07850040 0_2_07850040
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_091F0040 0_2_091F0040
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_091F34B8 0_2_091F34B8
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_091FED00 0_2_091FED00
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_091FECBC 0_2_091FECBC
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_091FF138 0_2_091FF138
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_091FF128 0_2_091FF128
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_091FF570 0_2_091FF570
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_091FF560 0_2_091FF560
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_091F34A8 0_2_091F34A8
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_091F6678 0_2_091F6678
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 0_2_091F6669 0_2_091F6669
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 7_2_018F4990 7_2_018F4990
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Code function: 7_2_018F17E8 7_2_018F17E8
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_0109D57C 8_2_0109D57C
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_05170006 8_2_05170006
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_05170040 8_2_05170040
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_081B5570 8_2_081B5570
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_081B0040 8_2_081B0040
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_081B0478 8_2_081B0478
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_081B1CE1 8_2_081B1CE1
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_08200040 8_2_08200040
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_082034B8 8_2_082034B8
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_0820ECCE 8_2_0820ECCE
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_0820ED00 8_2_0820ED00
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_0820F12A 8_2_0820F12A
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_0820F138 8_2_0820F138
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_082034A8 8_2_082034A8
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_0820F561 8_2_0820F561
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_0820F570 8_2_0820F570
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_08206669 8_2_08206669
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_08206678 8_2_08206678
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 13_2_014817E8 13_2_014817E8
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 13_2_01481E60 13_2_01481E60
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_014CD57C 14_2_014CD57C
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_073253F8 14_2_073253F8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_07320478 14_2_07320478
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_07320006 14_2_07320006
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_07320040 14_2_07320040
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_073734B8 14_2_073734B8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_07372106 14_2_07372106
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_07376678 14_2_07376678
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_07376669 14_2_07376669
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_0737F570 14_2_0737F570
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_073734A8 14_2_073734A8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_0737F138 14_2_0737F138
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 14_2_0737ED00 14_2_0737ED00
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 17_2_02F217E8 17_2_02F217E8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 17_2_02F21E60 17_2_02F21E60
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_0094D57C 19_2_0094D57C
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06A134B8 19_2_06A134B8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06A12106 19_2_06A12106
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06A16669 19_2_06A16669
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06A16678 19_2_06A16678
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06A16641 19_2_06A16641
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06A134A8 19_2_06A134A8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06A1F570 19_2_06A1F570
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06A1F138 19_2_06A1F138
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06A1ED00 19_2_06A1ED00
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06CA53F8 19_2_06CA53F8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06CA1CE1 19_2_06CA1CE1
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06CA0478 19_2_06CA0478
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 19_2_06CA0040 19_2_06CA0040
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Code function: 24_2_028917E8 24_2_028917E8
One or more processes crash
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 1852
Sample file is different than original file name gathered from version info
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715789896.0000000005BC0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameArthur.dll" vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameXClient.exe4 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000000.00000000.1668919070.0000000000C40000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameNHwE.exeP vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1714031582.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameArthur.dll" vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1714407255.000000000414B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1712988828.000000000127E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1716519696.0000000007890000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3833495488.0000000006119000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameXClient.exe4 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 0000000E.00000002.1848769926.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 0000000E.00000002.1851291561.0000000003F78000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 0000000E.00000002.1851291561.0000000003FC5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 0000000E.00000002.1850299737.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameArthur.dll" vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1914378902.000000000690D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameschtasks.exe.muij% vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1910962243.0000000003595000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1908285352.0000000002492000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameXClient.exe4 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1908285352.00000000023ED000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameArthur.dll" vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1910962243.0000000003548000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1908285352.0000000002489000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameXClient.exe4 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe Binary or memory string: OriginalFilenameNHwE.exeP vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe.7.dr Binary or memory string: OriginalFilenameNHwE.exeP vs 9758xBqgE1azKnB.exe
Uses 32bit PE files
Source: 9758xBqgE1azKnB.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000D.00000002.1753363260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000008.00000002.1747690067.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 9758xBqgE1azKnB.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: grjujyNaBLaKbU.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 9758xBqgE1azKnB.exe.7.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, rw6rw0BnvthyGxjk5e.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, rw6rw0BnvthyGxjk5e.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, rw6rw0BnvthyGxjk5e.cs Security API names: _0020.AddAccessRule
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, dWu4X2POSeE0PxkDow.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, dWu4X2POSeE0PxkDow.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, rw6rw0BnvthyGxjk5e.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, rw6rw0BnvthyGxjk5e.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, rw6rw0BnvthyGxjk5e.cs Security API names: _0020.AddAccessRule
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@33/21@0/1
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe File created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Mutant created: \Sessions\1\BaseNamedObjects\bNBVxUdiYnNCEgLdWmNnJcvXv
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Mutant created: NULL
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Mutant created: \Sessions\1\BaseNamedObjects\w8DsMRIhXrOmk0Gn
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6160:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3264:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8044:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6912
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe File created: C:\Users\user\AppData\Local\Temp\tmpAD87.tmp Jump to behavior
Source: 9758xBqgE1azKnB.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 9758xBqgE1azKnB.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 9758xBqgE1azKnB.exe ReversingLabs: Detection: 57%
Source: 9758xBqgE1azKnB.exe Virustotal: Detection: 54%
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe File read: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe"
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpAD87.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe"
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpBA0A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpE11A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmp21F.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 1852
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe" Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpAD87.tmp" Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe" Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpBA0A.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpE11A.tmp"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmp21F.tmp"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: 9758xBqgE1azKnB.lnk.7.dr LNK file: ..\..\..\..\..\9758xBqgE1azKnB.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: 9758xBqgE1azKnB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 9758xBqgE1azKnB.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: 9758xBqgE1azKnB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Windows\NHwE.pdbpdbHwE.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Xml.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Windows.Forms.pdbH source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\NHwE.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Accessibility.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.ni.pdbRSDS source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Core.pdbAccessibility.dll8 source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: \??\C:\Windows\exe\NHwE.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\exe\NHwE.pdbu source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Configuration.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.0000000001507000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Xml.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: o.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Xml.ni.pdbRSDS# source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: NHwE.pdbSHA256T source: 9758xBqgE1azKnB.exe, grjujyNaBLaKbU.exe.0.dr, 9758xBqgE1azKnB.exe.7.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Core.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: n0C:\Windows\mscorlib.pdbj~ source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: %%.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Windows.Forms.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdb% source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.000000000156C000.00000004.00000020.00020000.00000000.sdmp, WER1BE7.tmp.dmp.28.dr
Source: Binary string: NHwE.pdb source: 9758xBqgE1azKnB.exe, grjujyNaBLaKbU.exe.0.dr, 9758xBqgE1azKnB.exe.7.dr
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.000000000152A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbD source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Management.ni.pdbRSDSJ< source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Drawing.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Management.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: mscorlib.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Management.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: symbols\dll\mscorlib.pdbLb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\exe\NHwE.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WER1BE7.tmp.dmp.28.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
.NET source code contains potential unpacker
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, rw6rw0BnvthyGxjk5e.cs .Net Code: MTLR62MwZG System.Reflection.Assembly.Load(byte[])
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Messages.cs .Net Code: Memory
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Messages.cs .Net Code: Memory
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, rw6rw0BnvthyGxjk5e.cs .Net Code: MTLR62MwZG System.Reflection.Assembly.Load(byte[])
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Messages.cs .Net Code: Memory
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Messages.cs .Net Code: Memory
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Code function: 8_2_0820B913 push eax; retf 8_2_0820B91D
Source: 9758xBqgE1azKnB.exe Static PE information: section name: .text entropy: 7.9146348506405895
Source: grjujyNaBLaKbU.exe.0.dr Static PE information: section name: .text entropy: 7.9146348506405895
Source: 9758xBqgE1azKnB.exe.7.dr Static PE information: section name: .text entropy: 7.9146348506405895
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, lMrCMlzm8JgcqZan6j.cs High entropy of concatenated method names: 'cA5oKnDeou', 'PWooPwXbF5', 'dpEolbbYJD', 'eLBoxlVPbE', 'BbIoYe9T5H', 'eWKopNAMS7', 'ft4o9T9e53', 'CeYohkSvPY', 'rPgoCNIZ9N', 'OoGoSdCcI7'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, tP4sQN4ycAfk4RTrPD.cs High entropy of concatenated method names: 'ptb625Gys', 'msnI2FQDZ', 'xFPKxJB28', 'CJq8FeOMM', 'DRNlYykf4', 'MFsAxwA8F', 'VHwMsZn5qaRXoBVEAV', 'QUFS8Ijmg4nd478XUT', 'gxVsjeR3b', 'CWIomyXBC'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, EukKZG7BIlra3Zvh4J.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Tfb4fAm9st', 'fPH4HUvKcM', 'vt94zanV1I', 'p0KwLhOU8h', 'AWPwMyQ1hF', 'L4uw4rOZVE', 'jorwwc8JUv', 'EFC9ymNLxT8fLITSHdI'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, bdaIPTyqCvhKkGvBZ0.cs High entropy of concatenated method names: 'JVZtbeyfo8', 'fLHteXo97w', 'CkCttC4os1', 'L0etj9c8VZ', 'EogtGiHXPO', 'vijthM8355', 'Dispose', 'kLXsm2ZIfW', 'JrlsNQWJaE', 'j7ls7ZXlOp'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, B2X6TIA6OwcjisGogX.cs High entropy of concatenated method names: 'k2QqdjfgZ5', 'eLeq8Ftpnh', 'Jw97ikoIAC', 'i987pfwYMZ', 'vxu79ThvK9', 'bMJ7cynblv', 'K9d7OmOdpm', 'dmP73StVmr', 'XQc7g9wnpc', 'cIn7T1XoCF'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, JPU6JeZEfcOAh3VAxw.cs High entropy of concatenated method names: 'FMgbTXjbCK', 'uqZb1Vs1nh', 'SuDbZAuWsr', 'cfrbWkUplv', 'crYbYVOVeH', 'PdCbi5XQT8', 'qiEbpGCZsq', 'Etyb9QT1qs', 'XwNbc3fkbI', 'z89bOi6iXU'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, BfRKGsxfmapLDnyJae.cs High entropy of concatenated method names: 'MbSrafQdhs', 'WNYrNlajD9', 'JMUrqANN1W', 'OF1rkrPrwn', 'cGBrBHtKk2', 'CoYq58XgrI', 'aAnqEuqaSf', 'YQHqy03gBN', 'oC6qJSqequ', 'grPqfIOBvQ'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, rw6rw0BnvthyGxjk5e.cs High entropy of concatenated method names: 'KqpwaCvyRb', 'GdUwmRTqhL', 'sPIwNeNjTg', 'e7Zw75gqvZ', 'fONwq8WGVq', 'XRRwraVqAf', 'uILwk3RPMY', 'c0qwBpt8qH', 'cMewQjfnRs', 'jTvwvXj1jG'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, G0rrHkR3Regm38HbYK.cs High entropy of concatenated method names: 'hmRMkWu4X2', 'LSeMBE0Pxk', 'wAuMv3ak4X', 'UHnMu3d2X6', 'rGoMbgXKfR', 'BGsMnfmapL', 'RM4Zsa9v91jxrp3tyN', 'hy62Gm5BFHIFjtfOWS', 'DUNMMAYQlq', 'UXKMwmR6U4'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, etnqG0M40RuYQ2CGjgs.cs High entropy of concatenated method names: 'ToString', 'pYyjPN0WPl', 'Fn4jl9uRBK', 'H9njAaFHsF', 'ir7jx6YOxy', 'tPkjYgC6i8', 'LgXjiJGs3G', 'oPYjpUIa4S', 'X1FpvL0waeBwGC0jlB7', 'H9FsVx0GUf3cpEH2BN3'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, X0CI17Nm2rK9soP4pW.cs High entropy of concatenated method names: 'Dispose', 'lhKMfkGvBZ', 'wLZ4Yb88y8', 'c4VIJQdyrP', 'PTSMHyJ0i3', 'L9GMzXgcPq', 'ProcessDialogKey', 'lKv4L5r4yM', 'YRg4MaMpV6', 'c2a44F6kQq'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, IrSCmVMMhSAxy1sNwDY.cs High entropy of concatenated method names: 'XxkoHW3QiY', 'U83ozFLryS', 'bFmjLKjL4X', 'kyBjMBjEty', 'DK9j4WDA5V', 'U4HjwOMsdE', 'itFjRC0vK1', 'GtEjaYOSkx', 'eQAjm6S772', 'NOtjNL9pKk'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, dWu4X2POSeE0PxkDow.cs High entropy of concatenated method names: 'oD7NZBVV0S', 'AIWNWaldgO', 'qxkNFG9puw', 'fKgNDwWWJe', 'GLnN53mHdT', 'bW3NEP3ZyU', 'Q5tNyyPOWv', 'bpkNJAOnHj', 'LkxNfk38fL', 'BplNHAFPNF'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, S6kQq8H2YIZ3L9W7Iu.cs High entropy of concatenated method names: 'tMho7YfbJ6', 'r6Goq8Adjx', 'nHZornjoec', 'pH3okUIbbd', 'rENot4OdO8', 'rHmoBKKgIR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, A0S6FhlAu3ak4X5Hn3.cs High entropy of concatenated method names: 'htt7IrJ3mw', 'B4s7K7lYDA', 'GOZ7PChdSj', 'Pdd7lCHrkH', 'udF7bJwLu9', 'sKk7nvupqW', 'pPJ7ecpFw1', 't1B7sOKSjM', 'r8P7t6D93Y', 'jGN7oi2djJ'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, DxVbSFEWu8YfBsCZIJ.cs High entropy of concatenated method names: 'zoreJ9PuIV', 'rmweHajdJ2', 'icvsL2Ur4Q', 'JPbsM7QQEW', 'zUpeUjA7hS', 'Fahe1RdUB1', 'Ulue0lKtKh', 'TTseZXqNkm', 'AN0eW4FqNq', 'KM8eFJjY8k'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, l5r4yMfHRgaMpV6w2a.cs High entropy of concatenated method names: 'VEdtxa5GFe', 'NuytYIbGuT', 'aXQtiuMxof', 'apntp4Rte9', 'UPvt9U26ia', 'XLqtciOh64', 'XnstOf9FPd', 'gKnt3hCetx', 'ii7tgosKho', 'znPtTuWFgo'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, cgS87n0bF9R7j9LBfg.cs High entropy of concatenated method names: 'SkhVPu7f6k', 'g2iVlqVO2N', 'f4QVxFNQtO', 'UjdVYeXU67', 'WcEVp5uVer', 'xxxV9H1SA7', 'M7xVOJhJWj', 'bfMV3jTF4e', 'RsdVTId25Q', 'KW6VUWDu6S'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, RNpgfFMRE75cxe1a9ye.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'y8G2tr4KtS', 'AcX2oKYvAT', 'qnm2jRyMOv', 'oXH22sGkqe', 'IVd2GdxjUM', 'OwZ2Xax3wU', 'dpf2hbA0kp'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, KhXskcgjJb7WhBNB0e.cs High entropy of concatenated method names: 'yWEkCYqyrk', 'RUokS7Qv7W', 'XCIk6se4hQ', 'vSZkIi8q9t', 'ef6kd1LsIb', 'UcPkKiZpLo', 'O67k8UvCQR', 'NlGkPfLSnO', 'pG6klcfFWj', 'aTPkAeRCHR'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, Ai0pUZOnQWs6p8kWrU.cs High entropy of concatenated method names: 'lXKkmhsAiC', 'xQvk7l1Ah7', 'uFvkrNBmvv', 'b60rH8fCuL', 'VcQrzARj3C', 'HRskLtRtXG', 'H3GkMXNjkK', 'kUEk41gDxi', 'F0dkwcEmO6', 'rZNkRhq6NB'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, lMrCMlzm8JgcqZan6j.cs High entropy of concatenated method names: 'cA5oKnDeou', 'PWooPwXbF5', 'dpEolbbYJD', 'eLBoxlVPbE', 'BbIoYe9T5H', 'eWKopNAMS7', 'ft4o9T9e53', 'CeYohkSvPY', 'rPgoCNIZ9N', 'OoGoSdCcI7'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, tP4sQN4ycAfk4RTrPD.cs High entropy of concatenated method names: 'ptb625Gys', 'msnI2FQDZ', 'xFPKxJB28', 'CJq8FeOMM', 'DRNlYykf4', 'MFsAxwA8F', 'VHwMsZn5qaRXoBVEAV', 'QUFS8Ijmg4nd478XUT', 'gxVsjeR3b', 'CWIomyXBC'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, EukKZG7BIlra3Zvh4J.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Tfb4fAm9st', 'fPH4HUvKcM', 'vt94zanV1I', 'p0KwLhOU8h', 'AWPwMyQ1hF', 'L4uw4rOZVE', 'jorwwc8JUv', 'EFC9ymNLxT8fLITSHdI'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, bdaIPTyqCvhKkGvBZ0.cs High entropy of concatenated method names: 'JVZtbeyfo8', 'fLHteXo97w', 'CkCttC4os1', 'L0etj9c8VZ', 'EogtGiHXPO', 'vijthM8355', 'Dispose', 'kLXsm2ZIfW', 'JrlsNQWJaE', 'j7ls7ZXlOp'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, B2X6TIA6OwcjisGogX.cs High entropy of concatenated method names: 'k2QqdjfgZ5', 'eLeq8Ftpnh', 'Jw97ikoIAC', 'i987pfwYMZ', 'vxu79ThvK9', 'bMJ7cynblv', 'K9d7OmOdpm', 'dmP73StVmr', 'XQc7g9wnpc', 'cIn7T1XoCF'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, JPU6JeZEfcOAh3VAxw.cs High entropy of concatenated method names: 'FMgbTXjbCK', 'uqZb1Vs1nh', 'SuDbZAuWsr', 'cfrbWkUplv', 'crYbYVOVeH', 'PdCbi5XQT8', 'qiEbpGCZsq', 'Etyb9QT1qs', 'XwNbc3fkbI', 'z89bOi6iXU'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, BfRKGsxfmapLDnyJae.cs High entropy of concatenated method names: 'MbSrafQdhs', 'WNYrNlajD9', 'JMUrqANN1W', 'OF1rkrPrwn', 'cGBrBHtKk2', 'CoYq58XgrI', 'aAnqEuqaSf', 'YQHqy03gBN', 'oC6qJSqequ', 'grPqfIOBvQ'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, rw6rw0BnvthyGxjk5e.cs High entropy of concatenated method names: 'KqpwaCvyRb', 'GdUwmRTqhL', 'sPIwNeNjTg', 'e7Zw75gqvZ', 'fONwq8WGVq', 'XRRwraVqAf', 'uILwk3RPMY', 'c0qwBpt8qH', 'cMewQjfnRs', 'jTvwvXj1jG'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, G0rrHkR3Regm38HbYK.cs High entropy of concatenated method names: 'hmRMkWu4X2', 'LSeMBE0Pxk', 'wAuMv3ak4X', 'UHnMu3d2X6', 'rGoMbgXKfR', 'BGsMnfmapL', 'RM4Zsa9v91jxrp3tyN', 'hy62Gm5BFHIFjtfOWS', 'DUNMMAYQlq', 'UXKMwmR6U4'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, etnqG0M40RuYQ2CGjgs.cs High entropy of concatenated method names: 'ToString', 'pYyjPN0WPl', 'Fn4jl9uRBK', 'H9njAaFHsF', 'ir7jx6YOxy', 'tPkjYgC6i8', 'LgXjiJGs3G', 'oPYjpUIa4S', 'X1FpvL0waeBwGC0jlB7', 'H9FsVx0GUf3cpEH2BN3'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, X0CI17Nm2rK9soP4pW.cs High entropy of concatenated method names: 'Dispose', 'lhKMfkGvBZ', 'wLZ4Yb88y8', 'c4VIJQdyrP', 'PTSMHyJ0i3', 'L9GMzXgcPq', 'ProcessDialogKey', 'lKv4L5r4yM', 'YRg4MaMpV6', 'c2a44F6kQq'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, IrSCmVMMhSAxy1sNwDY.cs High entropy of concatenated method names: 'XxkoHW3QiY', 'U83ozFLryS', 'bFmjLKjL4X', 'kyBjMBjEty', 'DK9j4WDA5V', 'U4HjwOMsdE', 'itFjRC0vK1', 'GtEjaYOSkx', 'eQAjm6S772', 'NOtjNL9pKk'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, dWu4X2POSeE0PxkDow.cs High entropy of concatenated method names: 'oD7NZBVV0S', 'AIWNWaldgO', 'qxkNFG9puw', 'fKgNDwWWJe', 'GLnN53mHdT', 'bW3NEP3ZyU', 'Q5tNyyPOWv', 'bpkNJAOnHj', 'LkxNfk38fL', 'BplNHAFPNF'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, S6kQq8H2YIZ3L9W7Iu.cs High entropy of concatenated method names: 'tMho7YfbJ6', 'r6Goq8Adjx', 'nHZornjoec', 'pH3okUIbbd', 'rENot4OdO8', 'rHmoBKKgIR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, A0S6FhlAu3ak4X5Hn3.cs High entropy of concatenated method names: 'htt7IrJ3mw', 'B4s7K7lYDA', 'GOZ7PChdSj', 'Pdd7lCHrkH', 'udF7bJwLu9', 'sKk7nvupqW', 'pPJ7ecpFw1', 't1B7sOKSjM', 'r8P7t6D93Y', 'jGN7oi2djJ'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, DxVbSFEWu8YfBsCZIJ.cs High entropy of concatenated method names: 'zoreJ9PuIV', 'rmweHajdJ2', 'icvsL2Ur4Q', 'JPbsM7QQEW', 'zUpeUjA7hS', 'Fahe1RdUB1', 'Ulue0lKtKh', 'TTseZXqNkm', 'AN0eW4FqNq', 'KM8eFJjY8k'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, l5r4yMfHRgaMpV6w2a.cs High entropy of concatenated method names: 'VEdtxa5GFe', 'NuytYIbGuT', 'aXQtiuMxof', 'apntp4Rte9', 'UPvt9U26ia', 'XLqtciOh64', 'XnstOf9FPd', 'gKnt3hCetx', 'ii7tgosKho', 'znPtTuWFgo'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, cgS87n0bF9R7j9LBfg.cs High entropy of concatenated method names: 'SkhVPu7f6k', 'g2iVlqVO2N', 'f4QVxFNQtO', 'UjdVYeXU67', 'WcEVp5uVer', 'xxxV9H1SA7', 'M7xVOJhJWj', 'bfMV3jTF4e', 'RsdVTId25Q', 'KW6VUWDu6S'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, RNpgfFMRE75cxe1a9ye.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'y8G2tr4KtS', 'AcX2oKYvAT', 'qnm2jRyMOv', 'oXH22sGkqe', 'IVd2GdxjUM', 'OwZ2Xax3wU', 'dpf2hbA0kp'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, KhXskcgjJb7WhBNB0e.cs High entropy of concatenated method names: 'yWEkCYqyrk', 'RUokS7Qv7W', 'XCIk6se4hQ', 'vSZkIi8q9t', 'ef6kd1LsIb', 'UcPkKiZpLo', 'O67k8UvCQR', 'NlGkPfLSnO', 'pG6klcfFWj', 'aTPkAeRCHR'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, Ai0pUZOnQWs6p8kWrU.cs High entropy of concatenated method names: 'lXKkmhsAiC', 'xQvk7l1Ah7', 'uFvkrNBmvv', 'b60rH8fCuL', 'VcQrzARj3C', 'HRskLtRtXG', 'H3GkMXNjkK', 'kUEk41gDxi', 'F0dkwcEmO6', 'rZNkRhq6NB'
Drops PE files
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe File created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Jump to dropped file
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe File created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpAD87.tmp"
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9758xBqgE1azKnB.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9758xBqgE1azKnB.lnk Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9758xBqgE1azKnB Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9758xBqgE1azKnB Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7128, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: grjujyNaBLaKbU.exe PID: 888, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7568, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7868, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Memory allocated: 14C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Memory allocated: 2FE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Memory allocated: 2E00000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Memory allocated: 9200000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Memory allocated: A200000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Memory allocated: A410000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Memory allocated: B410000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Memory allocated: 18F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Memory allocated: 32A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Memory allocated: 30B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Memory allocated: 1090000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Memory allocated: 2B00000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Memory allocated: 4B00000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Memory allocated: 8660000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Memory allocated: 9660000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Memory allocated: 9850000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Memory allocated: A850000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Memory allocated: 1480000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Memory allocated: 2E60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Memory allocated: 4E60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 1480000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 2DE0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 4DE0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 8A40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 9A40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 9C30000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: AC30000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 2F00000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 3170000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 2F80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 940000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 23B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 43B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 8130000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 9130000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 9320000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: A320000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 2890000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 2AF0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory allocated: 2910000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6157 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3611 Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Window / User API: threadDelayed 2612 Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Window / User API: threadDelayed 7227 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe TID: 7156 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe TID: 6240 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2300 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe TID: 7492 Thread sleep time: -32281802128991695s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe TID: 5924 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe TID: 7184 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe TID: 7428 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe TID: 7572 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe TID: 7592 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe TID: 7728 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe TID: 7872 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe TID: 7884 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe TID: 8108 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Thread delayed: delay time: 922337203685477
Source: Amcache.hve.28.dr Binary or memory string: VMware
Source: Amcache.hve.28.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.28.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.28.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.28.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.28.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.28.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.28.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.28.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1914378902.00000000068D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Prod_VMware_
Source: Amcache.hve.28.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.28.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.28.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.0000000001577000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllx
Source: Amcache.hve.28.dr Binary or memory string: vmci.sys
Source: Amcache.hve.28.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.28.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.28.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.28.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.28.dr Binary or memory string: VMware20,1
Source: Amcache.hve.28.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.28.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.28.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.28.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.28.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.28.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.28.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.28.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.28.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.28.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.28.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Memory written: C:\Users\user\Desktop\9758xBqgE1azKnB.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Memory written: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory written: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Memory written: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe base: 400000 value starts with: 4D5A
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe" Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpAD87.tmp" Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe" Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpBA0A.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpE11A.tmp"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmp21F.tmp"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: @\tq@\tq-PING!<Xwormmm>Program Manager<Xwormmm>2003543
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>2008415
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.0000000003563000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035B3000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.0000000003563000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $tq'PING!<Xwormmm>Program Manager<Xwormmm>0Tetqh7V
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>2003543
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $tq-PING!<Xwormmm>Program Manager<Xwormmm>1795112Tetq
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035B3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $tq'PING!<Xwormmm>Program Manager<Xwormmm>0Tetqh7[
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $tq-PING!<Xwormmm>Program Manager<Xwormmm>2003543Tetq
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $tq'PING!<Xwormmm>Program Manager<Xwormmm>0Tetqhw\
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>1795112
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $tq'PING!<Xwormmm>Program Manager<Xwormmm>0Tetqh7_
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: $tq-PING!<Xwormmm>Program Manager<Xwormmm>2008415Tetq
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: @\tq@\tq-PING!<Xwormmm>Program Manager<Xwormmm>2008415
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.0000000003563000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035B3000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: @\tq@\tq'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: @\tq@\tq-PING!<Xwormmm>Program Manager<Xwormmm>1795112
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.0000000003563000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035B3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Managert-tq
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Users\user\Desktop\9758xBqgE1azKnB.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Users\user\Desktop\9758xBqgE1azKnB.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Queries volume information: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Queries volume information: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.28.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.28.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.28.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.0000000001507000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.28.dr Binary or memory string: MsMpEng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected XWorm
Source: Yara match File source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.1753363260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1747690067.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.3827541610.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7128, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 6912, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: grjujyNaBLaKbU.exe PID: 888, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: grjujyNaBLaKbU.exe PID: 7400, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7568, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected XWorm
Source: Yara match File source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.1753363260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1747690067.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.3827541610.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7128, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 6912, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: grjujyNaBLaKbU.exe PID: 888, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: grjujyNaBLaKbU.exe PID: 7400, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7568, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1562040 Sample: 9758xBqgE1azKnB.exe Startdate: 25/11/2024 Architecture: WINDOWS Score: 100 64 Suricata IDS alerts for network traffic 2->64 66 Found malware configuration 2->66 68 Malicious sample detected (through community Yara rule) 2->68 70 12 other signatures 2->70 7 9758xBqgE1azKnB.exe 7 2->7         started        11 grjujyNaBLaKbU.exe 5 2->11         started        13 9758xBqgE1azKnB.exe 2->13         started        15 9758xBqgE1azKnB.exe 2->15         started        process3 file4 54 C:\Users\user\AppData\...\grjujyNaBLaKbU.exe, PE32 7->54 dropped 56 C:\...\grjujyNaBLaKbU.exe:Zone.Identifier, ASCII 7->56 dropped 58 C:\Users\user\AppData\Local\...\tmpAD87.tmp, XML 7->58 dropped 60 C:\Users\user\...\9758xBqgE1azKnB.exe.log, ASCII 7->60 dropped 76 Uses schtasks.exe or at.exe to add and modify task schedules 7->76 78 Adds a directory exclusion to Windows Defender 7->78 80 Injects a PE file into a foreign processes 7->80 17 9758xBqgE1azKnB.exe 1 7 7->17         started        22 powershell.exe 23 7->22         started        24 schtasks.exe 1 7->24         started        26 9758xBqgE1azKnB.exe 7->26         started        82 Multi AV Scanner detection for dropped file 11->82 84 Machine Learning detection for dropped file 11->84 28 schtasks.exe 1 11->28         started        34 2 other processes 11->34 30 schtasks.exe 13->30         started        32 9758xBqgE1azKnB.exe 13->32         started        36 2 other processes 15->36 signatures5 process6 dnsIp7 62 18.181.154.24, 49735, 7000 AMAZON-02US United States 17->62 52 C:\Users\user\AppData\...\9758xBqgE1azKnB.exe, PE32 17->52 dropped 72 Protects its processes via BreakOnTermination flag 17->72 38 WerFault.exe 17->38         started        74 Loading BitLocker PowerShell Module 22->74 40 WmiPrvSE.exe 22->40         started        42 conhost.exe 22->42         started        44 conhost.exe 24->44         started        46 conhost.exe 28->46         started        48 conhost.exe 30->48         started        50 conhost.exe 36->50         started        file8 signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
18.181.154.24
 unknown United States
16509 AMAZON-02US true

Contacted URLs

Name Malicious Antivirus Detection Reputation
18.181.154.24 true
  • Avira URL Cloud: safe
 unknown