Windows Analysis Report
9758xBqgE1azKnB.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000D.00000002.1753363260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000008.00000002.1747690067.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_0150D57C	0_2_0150D57C
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_078562C8	0_2_078562C8
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_07851D18	0_2_07851D18
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_07850478	0_2_07850478
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_07850040	0_2_07850040
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_091F0040	0_2_091F0040
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_091F34B8	0_2_091F34B8
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_091FED00	0_2_091FED00
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_091FECBC	0_2_091FECBC
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_091FF138	0_2_091FF138
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_091FF128	0_2_091FF128
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_091FF570	0_2_091FF570
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_091FF560	0_2_091FF560
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_091F34A8	0_2_091F34A8
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_091F6678	0_2_091F6678
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 0_2_091F6669	0_2_091F6669
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 7_2_018F4990	7_2_018F4990
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Code function: 7_2_018F17E8	7_2_018F17E8
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_0109D57C	8_2_0109D57C
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_05170006	8_2_05170006
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_05170040	8_2_05170040
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_081B5570	8_2_081B5570
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_081B0040	8_2_081B0040
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_081B0478	8_2_081B0478
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_081B1CE1	8_2_081B1CE1
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_08200040	8_2_08200040
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_082034B8	8_2_082034B8
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_0820ECCE	8_2_0820ECCE
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_0820ED00	8_2_0820ED00
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_0820F12A	8_2_0820F12A
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_0820F138	8_2_0820F138
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_082034A8	8_2_082034A8
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_0820F561	8_2_0820F561
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_0820F570	8_2_0820F570
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_08206669	8_2_08206669
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 8_2_08206678	8_2_08206678
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 13_2_014817E8	13_2_014817E8
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Code function: 13_2_01481E60	13_2_01481E60
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_014CD57C	14_2_014CD57C
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_073253F8	14_2_073253F8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_07320478	14_2_07320478
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_07320006	14_2_07320006
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_07320040	14_2_07320040
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_073734B8	14_2_073734B8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_07372106	14_2_07372106
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_07376678	14_2_07376678
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_07376669	14_2_07376669
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_0737F570	14_2_0737F570
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_073734A8	14_2_073734A8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_0737F138	14_2_0737F138
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 14_2_0737ED00	14_2_0737ED00
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 17_2_02F217E8	17_2_02F217E8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 17_2_02F21E60	17_2_02F21E60
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_0094D57C	19_2_0094D57C
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06A134B8	19_2_06A134B8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06A12106	19_2_06A12106
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06A16669	19_2_06A16669
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06A16678	19_2_06A16678
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06A16641	19_2_06A16641
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06A134A8	19_2_06A134A8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06A1F570	19_2_06A1F570
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06A1F138	19_2_06A1F138
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06A1ED00	19_2_06A1ED00
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06CA53F8	19_2_06CA53F8
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06CA1CE1	19_2_06CA1CE1
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06CA0478	19_2_06CA0478
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 19_2_06CA0040	19_2_06CA0040
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Code function: 24_2_028917E8	24_2_028917E8

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 1852

Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1715789896.0000000005BC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000000.00000000.1668919070.0000000000C40000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNHwE.exeP vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1714031582.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1714407255.000000000414B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1712988828.000000000127E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000000.00000002.1716519696.0000000007890000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3833495488.0000000006119000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 0000000E.00000002.1848769926.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 0000000E.00000002.1851291561.0000000003F78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 0000000E.00000002.1851291561.0000000003FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 0000000E.00000002.1850299737.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1914378902.000000000690D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameschtasks.exe.muij% vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1910962243.0000000003595000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1908285352.0000000002492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1908285352.00000000023ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1910962243.0000000003548000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1908285352.0000000002489000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe	Binary or memory string: OriginalFilenameNHwE.exeP vs 9758xBqgE1azKnB.exe
Source: 9758xBqgE1azKnB.exe.7.dr	Binary or memory string: OriginalFilenameNHwE.exeP vs 9758xBqgE1azKnB.exe

Source: 9758xBqgE1azKnB.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000D.00000002.1753363260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000008.00000002.1747690067.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 9758xBqgE1azKnB.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: grjujyNaBLaKbU.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 9758xBqgE1azKnB.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, rw6rw0BnvthyGxjk5e.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, rw6rw0BnvthyGxjk5e.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, rw6rw0BnvthyGxjk5e.cs	Security API names: _0020.AddAccessRule
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, dWu4X2POSeE0PxkDow.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, dWu4X2POSeE0PxkDow.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, rw6rw0BnvthyGxjk5e.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, rw6rw0BnvthyGxjk5e.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, rw6rw0BnvthyGxjk5e.cs	Security API names: _0020.AddAccessRule
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@33/21@0/1

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

File created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe

Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Mutant created: \Sessions\1\BaseNamedObjects\bNBVxUdiYnNCEgLdWmNnJcvXv
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Mutant created: \Sessions\1\BaseNamedObjects\w8DsMRIhXrOmk0Gn
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6160:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3264:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8044:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6912
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

File created: C:\Users\user\AppData\Local\Temp\tmpAD87.tmp

Source: 9758xBqgE1azKnB.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 9758xBqgE1azKnB.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: 9758xBqgE1azKnB.exe	ReversingLabs: Detection: 57%
Source: 9758xBqgE1azKnB.exe	Virustotal: Detection: 54%

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

File read: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

Source: unknown	Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe"
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpAD87.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe"
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpBA0A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpE11A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmp21F.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 1852
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpAD87.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe"	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpBA0A.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpE11A.tmp"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmp21F.tmp"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: 9758xBqgE1azKnB.lnk.7.dr

LNK file: ..\..\..\..\..\9758xBqgE1azKnB.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: 9758xBqgE1azKnB.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 9758xBqgE1azKnB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 9758xBqgE1azKnB.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Windows\NHwE.pdbpdbHwE.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: System.Windows.Forms.pdbH source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\NHwE.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Accessibility.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: System.ni.pdbRSDS source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: System.Core.pdbAccessibility.dll8 source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: \??\C:\Windows\exe\NHwE.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\NHwE.pdbu source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: System.Configuration.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.0000000001507000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: o.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: NHwE.pdbSHA256T source: 9758xBqgE1azKnB.exe, grjujyNaBLaKbU.exe.0.dr, 9758xBqgE1azKnB.exe.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: System.Core.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: n0C:\Windows\mscorlib.pdbj~ source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: %%.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb% source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.000000000156C000.00000004.00000020.00020000.00000000.sdmp, WER1BE7.tmp.dmp.28.dr
Source:	Binary string: NHwE.pdb source: 9758xBqgE1azKnB.exe, grjujyNaBLaKbU.exe.0.dr, 9758xBqgE1azKnB.exe.7.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.000000000152A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbD source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: System.Drawing.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: System.Management.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: mscorlib.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: System.Management.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834152257.00000000063AA000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\NHwE.pdb source: 9758xBqgE1azKnB.exe, 00000007.00000002.3834781013.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: System.ni.pdb source: WER1BE7.tmp.dmp.28.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER1BE7.tmp.dmp.28.dr

Data Obfuscation

Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, rw6rw0BnvthyGxjk5e.cs	.Net Code: MTLR62MwZG System.Reflection.Assembly.Load(byte[])
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, Messages.cs	.Net Code: Memory
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, Messages.cs	.Net Code: Memory
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, rw6rw0BnvthyGxjk5e.cs	.Net Code: MTLR62MwZG System.Reflection.Assembly.Load(byte[])
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, Messages.cs	.Net Code: Memory
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, Messages.cs	.Net Code: Memory

Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe

Code function: 8_2_0820B913 push eax; retf

8_2_0820B91D

Source: 9758xBqgE1azKnB.exe	Static PE information: section name: .text entropy: 7.9146348506405895
Source: grjujyNaBLaKbU.exe.0.dr	Static PE information: section name: .text entropy: 7.9146348506405895
Source: 9758xBqgE1azKnB.exe.7.dr	Static PE information: section name: .text entropy: 7.9146348506405895

Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, lMrCMlzm8JgcqZan6j.cs	High entropy of concatenated method names: 'cA5oKnDeou', 'PWooPwXbF5', 'dpEolbbYJD', 'eLBoxlVPbE', 'BbIoYe9T5H', 'eWKopNAMS7', 'ft4o9T9e53', 'CeYohkSvPY', 'rPgoCNIZ9N', 'OoGoSdCcI7'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, tP4sQN4ycAfk4RTrPD.cs	High entropy of concatenated method names: 'ptb625Gys', 'msnI2FQDZ', 'xFPKxJB28', 'CJq8FeOMM', 'DRNlYykf4', 'MFsAxwA8F', 'VHwMsZn5qaRXoBVEAV', 'QUFS8Ijmg4nd478XUT', 'gxVsjeR3b', 'CWIomyXBC'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, EukKZG7BIlra3Zvh4J.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Tfb4fAm9st', 'fPH4HUvKcM', 'vt94zanV1I', 'p0KwLhOU8h', 'AWPwMyQ1hF', 'L4uw4rOZVE', 'jorwwc8JUv', 'EFC9ymNLxT8fLITSHdI'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, bdaIPTyqCvhKkGvBZ0.cs	High entropy of concatenated method names: 'JVZtbeyfo8', 'fLHteXo97w', 'CkCttC4os1', 'L0etj9c8VZ', 'EogtGiHXPO', 'vijthM8355', 'Dispose', 'kLXsm2ZIfW', 'JrlsNQWJaE', 'j7ls7ZXlOp'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, B2X6TIA6OwcjisGogX.cs	High entropy of concatenated method names: 'k2QqdjfgZ5', 'eLeq8Ftpnh', 'Jw97ikoIAC', 'i987pfwYMZ', 'vxu79ThvK9', 'bMJ7cynblv', 'K9d7OmOdpm', 'dmP73StVmr', 'XQc7g9wnpc', 'cIn7T1XoCF'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, JPU6JeZEfcOAh3VAxw.cs	High entropy of concatenated method names: 'FMgbTXjbCK', 'uqZb1Vs1nh', 'SuDbZAuWsr', 'cfrbWkUplv', 'crYbYVOVeH', 'PdCbi5XQT8', 'qiEbpGCZsq', 'Etyb9QT1qs', 'XwNbc3fkbI', 'z89bOi6iXU'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, BfRKGsxfmapLDnyJae.cs	High entropy of concatenated method names: 'MbSrafQdhs', 'WNYrNlajD9', 'JMUrqANN1W', 'OF1rkrPrwn', 'cGBrBHtKk2', 'CoYq58XgrI', 'aAnqEuqaSf', 'YQHqy03gBN', 'oC6qJSqequ', 'grPqfIOBvQ'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, rw6rw0BnvthyGxjk5e.cs	High entropy of concatenated method names: 'KqpwaCvyRb', 'GdUwmRTqhL', 'sPIwNeNjTg', 'e7Zw75gqvZ', 'fONwq8WGVq', 'XRRwraVqAf', 'uILwk3RPMY', 'c0qwBpt8qH', 'cMewQjfnRs', 'jTvwvXj1jG'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, G0rrHkR3Regm38HbYK.cs	High entropy of concatenated method names: 'hmRMkWu4X2', 'LSeMBE0Pxk', 'wAuMv3ak4X', 'UHnMu3d2X6', 'rGoMbgXKfR', 'BGsMnfmapL', 'RM4Zsa9v91jxrp3tyN', 'hy62Gm5BFHIFjtfOWS', 'DUNMMAYQlq', 'UXKMwmR6U4'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, etnqG0M40RuYQ2CGjgs.cs	High entropy of concatenated method names: 'ToString', 'pYyjPN0WPl', 'Fn4jl9uRBK', 'H9njAaFHsF', 'ir7jx6YOxy', 'tPkjYgC6i8', 'LgXjiJGs3G', 'oPYjpUIa4S', 'X1FpvL0waeBwGC0jlB7', 'H9FsVx0GUf3cpEH2BN3'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, X0CI17Nm2rK9soP4pW.cs	High entropy of concatenated method names: 'Dispose', 'lhKMfkGvBZ', 'wLZ4Yb88y8', 'c4VIJQdyrP', 'PTSMHyJ0i3', 'L9GMzXgcPq', 'ProcessDialogKey', 'lKv4L5r4yM', 'YRg4MaMpV6', 'c2a44F6kQq'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, IrSCmVMMhSAxy1sNwDY.cs	High entropy of concatenated method names: 'XxkoHW3QiY', 'U83ozFLryS', 'bFmjLKjL4X', 'kyBjMBjEty', 'DK9j4WDA5V', 'U4HjwOMsdE', 'itFjRC0vK1', 'GtEjaYOSkx', 'eQAjm6S772', 'NOtjNL9pKk'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, dWu4X2POSeE0PxkDow.cs	High entropy of concatenated method names: 'oD7NZBVV0S', 'AIWNWaldgO', 'qxkNFG9puw', 'fKgNDwWWJe', 'GLnN53mHdT', 'bW3NEP3ZyU', 'Q5tNyyPOWv', 'bpkNJAOnHj', 'LkxNfk38fL', 'BplNHAFPNF'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, S6kQq8H2YIZ3L9W7Iu.cs	High entropy of concatenated method names: 'tMho7YfbJ6', 'r6Goq8Adjx', 'nHZornjoec', 'pH3okUIbbd', 'rENot4OdO8', 'rHmoBKKgIR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, A0S6FhlAu3ak4X5Hn3.cs	High entropy of concatenated method names: 'htt7IrJ3mw', 'B4s7K7lYDA', 'GOZ7PChdSj', 'Pdd7lCHrkH', 'udF7bJwLu9', 'sKk7nvupqW', 'pPJ7ecpFw1', 't1B7sOKSjM', 'r8P7t6D93Y', 'jGN7oi2djJ'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, DxVbSFEWu8YfBsCZIJ.cs	High entropy of concatenated method names: 'zoreJ9PuIV', 'rmweHajdJ2', 'icvsL2Ur4Q', 'JPbsM7QQEW', 'zUpeUjA7hS', 'Fahe1RdUB1', 'Ulue0lKtKh', 'TTseZXqNkm', 'AN0eW4FqNq', 'KM8eFJjY8k'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, l5r4yMfHRgaMpV6w2a.cs	High entropy of concatenated method names: 'VEdtxa5GFe', 'NuytYIbGuT', 'aXQtiuMxof', 'apntp4Rte9', 'UPvt9U26ia', 'XLqtciOh64', 'XnstOf9FPd', 'gKnt3hCetx', 'ii7tgosKho', 'znPtTuWFgo'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, cgS87n0bF9R7j9LBfg.cs	High entropy of concatenated method names: 'SkhVPu7f6k', 'g2iVlqVO2N', 'f4QVxFNQtO', 'UjdVYeXU67', 'WcEVp5uVer', 'xxxV9H1SA7', 'M7xVOJhJWj', 'bfMV3jTF4e', 'RsdVTId25Q', 'KW6VUWDu6S'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, RNpgfFMRE75cxe1a9ye.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'y8G2tr4KtS', 'AcX2oKYvAT', 'qnm2jRyMOv', 'oXH22sGkqe', 'IVd2GdxjUM', 'OwZ2Xax3wU', 'dpf2hbA0kp'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, KhXskcgjJb7WhBNB0e.cs	High entropy of concatenated method names: 'yWEkCYqyrk', 'RUokS7Qv7W', 'XCIk6se4hQ', 'vSZkIi8q9t', 'ef6kd1LsIb', 'UcPkKiZpLo', 'O67k8UvCQR', 'NlGkPfLSnO', 'pG6klcfFWj', 'aTPkAeRCHR'
Source: 0.2.9758xBqgE1azKnB.exe.7890000.5.raw.unpack, Ai0pUZOnQWs6p8kWrU.cs	High entropy of concatenated method names: 'lXKkmhsAiC', 'xQvk7l1Ah7', 'uFvkrNBmvv', 'b60rH8fCuL', 'VcQrzARj3C', 'HRskLtRtXG', 'H3GkMXNjkK', 'kUEk41gDxi', 'F0dkwcEmO6', 'rZNkRhq6NB'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, lMrCMlzm8JgcqZan6j.cs	High entropy of concatenated method names: 'cA5oKnDeou', 'PWooPwXbF5', 'dpEolbbYJD', 'eLBoxlVPbE', 'BbIoYe9T5H', 'eWKopNAMS7', 'ft4o9T9e53', 'CeYohkSvPY', 'rPgoCNIZ9N', 'OoGoSdCcI7'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, tP4sQN4ycAfk4RTrPD.cs	High entropy of concatenated method names: 'ptb625Gys', 'msnI2FQDZ', 'xFPKxJB28', 'CJq8FeOMM', 'DRNlYykf4', 'MFsAxwA8F', 'VHwMsZn5qaRXoBVEAV', 'QUFS8Ijmg4nd478XUT', 'gxVsjeR3b', 'CWIomyXBC'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, EukKZG7BIlra3Zvh4J.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Tfb4fAm9st', 'fPH4HUvKcM', 'vt94zanV1I', 'p0KwLhOU8h', 'AWPwMyQ1hF', 'L4uw4rOZVE', 'jorwwc8JUv', 'EFC9ymNLxT8fLITSHdI'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, bdaIPTyqCvhKkGvBZ0.cs	High entropy of concatenated method names: 'JVZtbeyfo8', 'fLHteXo97w', 'CkCttC4os1', 'L0etj9c8VZ', 'EogtGiHXPO', 'vijthM8355', 'Dispose', 'kLXsm2ZIfW', 'JrlsNQWJaE', 'j7ls7ZXlOp'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, B2X6TIA6OwcjisGogX.cs	High entropy of concatenated method names: 'k2QqdjfgZ5', 'eLeq8Ftpnh', 'Jw97ikoIAC', 'i987pfwYMZ', 'vxu79ThvK9', 'bMJ7cynblv', 'K9d7OmOdpm', 'dmP73StVmr', 'XQc7g9wnpc', 'cIn7T1XoCF'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, JPU6JeZEfcOAh3VAxw.cs	High entropy of concatenated method names: 'FMgbTXjbCK', 'uqZb1Vs1nh', 'SuDbZAuWsr', 'cfrbWkUplv', 'crYbYVOVeH', 'PdCbi5XQT8', 'qiEbpGCZsq', 'Etyb9QT1qs', 'XwNbc3fkbI', 'z89bOi6iXU'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, BfRKGsxfmapLDnyJae.cs	High entropy of concatenated method names: 'MbSrafQdhs', 'WNYrNlajD9', 'JMUrqANN1W', 'OF1rkrPrwn', 'cGBrBHtKk2', 'CoYq58XgrI', 'aAnqEuqaSf', 'YQHqy03gBN', 'oC6qJSqequ', 'grPqfIOBvQ'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, rw6rw0BnvthyGxjk5e.cs	High entropy of concatenated method names: 'KqpwaCvyRb', 'GdUwmRTqhL', 'sPIwNeNjTg', 'e7Zw75gqvZ', 'fONwq8WGVq', 'XRRwraVqAf', 'uILwk3RPMY', 'c0qwBpt8qH', 'cMewQjfnRs', 'jTvwvXj1jG'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, G0rrHkR3Regm38HbYK.cs	High entropy of concatenated method names: 'hmRMkWu4X2', 'LSeMBE0Pxk', 'wAuMv3ak4X', 'UHnMu3d2X6', 'rGoMbgXKfR', 'BGsMnfmapL', 'RM4Zsa9v91jxrp3tyN', 'hy62Gm5BFHIFjtfOWS', 'DUNMMAYQlq', 'UXKMwmR6U4'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, etnqG0M40RuYQ2CGjgs.cs	High entropy of concatenated method names: 'ToString', 'pYyjPN0WPl', 'Fn4jl9uRBK', 'H9njAaFHsF', 'ir7jx6YOxy', 'tPkjYgC6i8', 'LgXjiJGs3G', 'oPYjpUIa4S', 'X1FpvL0waeBwGC0jlB7', 'H9FsVx0GUf3cpEH2BN3'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, X0CI17Nm2rK9soP4pW.cs	High entropy of concatenated method names: 'Dispose', 'lhKMfkGvBZ', 'wLZ4Yb88y8', 'c4VIJQdyrP', 'PTSMHyJ0i3', 'L9GMzXgcPq', 'ProcessDialogKey', 'lKv4L5r4yM', 'YRg4MaMpV6', 'c2a44F6kQq'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, IrSCmVMMhSAxy1sNwDY.cs	High entropy of concatenated method names: 'XxkoHW3QiY', 'U83ozFLryS', 'bFmjLKjL4X', 'kyBjMBjEty', 'DK9j4WDA5V', 'U4HjwOMsdE', 'itFjRC0vK1', 'GtEjaYOSkx', 'eQAjm6S772', 'NOtjNL9pKk'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, dWu4X2POSeE0PxkDow.cs	High entropy of concatenated method names: 'oD7NZBVV0S', 'AIWNWaldgO', 'qxkNFG9puw', 'fKgNDwWWJe', 'GLnN53mHdT', 'bW3NEP3ZyU', 'Q5tNyyPOWv', 'bpkNJAOnHj', 'LkxNfk38fL', 'BplNHAFPNF'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, S6kQq8H2YIZ3L9W7Iu.cs	High entropy of concatenated method names: 'tMho7YfbJ6', 'r6Goq8Adjx', 'nHZornjoec', 'pH3okUIbbd', 'rENot4OdO8', 'rHmoBKKgIR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, A0S6FhlAu3ak4X5Hn3.cs	High entropy of concatenated method names: 'htt7IrJ3mw', 'B4s7K7lYDA', 'GOZ7PChdSj', 'Pdd7lCHrkH', 'udF7bJwLu9', 'sKk7nvupqW', 'pPJ7ecpFw1', 't1B7sOKSjM', 'r8P7t6D93Y', 'jGN7oi2djJ'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, DxVbSFEWu8YfBsCZIJ.cs	High entropy of concatenated method names: 'zoreJ9PuIV', 'rmweHajdJ2', 'icvsL2Ur4Q', 'JPbsM7QQEW', 'zUpeUjA7hS', 'Fahe1RdUB1', 'Ulue0lKtKh', 'TTseZXqNkm', 'AN0eW4FqNq', 'KM8eFJjY8k'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, l5r4yMfHRgaMpV6w2a.cs	High entropy of concatenated method names: 'VEdtxa5GFe', 'NuytYIbGuT', 'aXQtiuMxof', 'apntp4Rte9', 'UPvt9U26ia', 'XLqtciOh64', 'XnstOf9FPd', 'gKnt3hCetx', 'ii7tgosKho', 'znPtTuWFgo'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, cgS87n0bF9R7j9LBfg.cs	High entropy of concatenated method names: 'SkhVPu7f6k', 'g2iVlqVO2N', 'f4QVxFNQtO', 'UjdVYeXU67', 'WcEVp5uVer', 'xxxV9H1SA7', 'M7xVOJhJWj', 'bfMV3jTF4e', 'RsdVTId25Q', 'KW6VUWDu6S'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, RNpgfFMRE75cxe1a9ye.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'y8G2tr4KtS', 'AcX2oKYvAT', 'qnm2jRyMOv', 'oXH22sGkqe', 'IVd2GdxjUM', 'OwZ2Xax3wU', 'dpf2hbA0kp'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, KhXskcgjJb7WhBNB0e.cs	High entropy of concatenated method names: 'yWEkCYqyrk', 'RUokS7Qv7W', 'XCIk6se4hQ', 'vSZkIi8q9t', 'ef6kd1LsIb', 'UcPkKiZpLo', 'O67k8UvCQR', 'NlGkPfLSnO', 'pG6klcfFWj', 'aTPkAeRCHR'
Source: 0.2.9758xBqgE1azKnB.exe.4178690.3.raw.unpack, Ai0pUZOnQWs6p8kWrU.cs	High entropy of concatenated method names: 'lXKkmhsAiC', 'xQvk7l1Ah7', 'uFvkrNBmvv', 'b60rH8fCuL', 'VcQrzARj3C', 'HRskLtRtXG', 'H3GkMXNjkK', 'kUEk41gDxi', 'F0dkwcEmO6', 'rZNkRhq6NB'

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	File created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe			Jump to dropped file
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	File created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpAD87.tmp"

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9758xBqgE1azKnB.lnk

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9758xBqgE1azKnB.lnk

Loading BitLocker PowerShell Module

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9758xBqgE1azKnB			Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9758xBqgE1azKnB			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: grjujyNaBLaKbU.exe PID: 888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7868, type: MEMORYSTR

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Memory allocated: 14C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Memory allocated: 2FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Memory allocated: 2E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Memory allocated: 9200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Memory allocated: A200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Memory allocated: A410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Memory allocated: B410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Memory allocated: 18F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Memory allocated: 32A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Memory allocated: 30B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Memory allocated: 1090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Memory allocated: 2B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Memory allocated: 4B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Memory allocated: 8660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Memory allocated: 9660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Memory allocated: 9850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Memory allocated: A850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Memory allocated: 2E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Memory allocated: 4E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 1480000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 2DE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 4DE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 8A40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 9A40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 9C30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: AC30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 2F00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 3170000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 2F80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 940000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 23B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 43B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 8130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 9130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 9320000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: A320000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 2890000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory allocated: 2910000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6157	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3611	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Window / User API: threadDelayed 2612	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Window / User API: threadDelayed 7227	Jump to behavior

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe TID: 7156	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe TID: 6240	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2300	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe TID: 7492	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe TID: 5924	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe TID: 7184	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe TID: 7428	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe TID: 7572	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe TID: 7592	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe TID: 7728	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe TID: 7872	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe TID: 7884	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe TID: 8108	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Thread delayed: delay time: 922337203685477

Source: Amcache.hve.28.dr	Binary or memory string: VMware
Source: Amcache.hve.28.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.28.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.28.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.28.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.28.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.28.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.28.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.28.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 9758xBqgE1azKnB.exe, 00000013.00000002.1914378902.00000000068D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_
Source: Amcache.hve.28.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.28.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.28.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.0000000001577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllx
Source: Amcache.hve.28.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.28.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.28.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.28.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.28.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.28.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.28.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.28.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.28.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.28.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.28.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.28.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.28.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.28.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.28.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.28.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.28.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Memory written: C:\Users\user\Desktop\9758xBqgE1azKnB.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Memory written: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory written: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Memory written: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpAD87.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe"	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Process created: C:\Users\user\Desktop\9758xBqgE1azKnB.exe "C:\Users\user\Desktop\9758xBqgE1azKnB.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpBA0A.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Process created: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpE11A.tmp"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmp21F.tmp"
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Process created: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe "C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"

Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\tq@\tq-PING!<Xwormmm>Program Manager<Xwormmm>2003543
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>2008415
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.0000000003563000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035B3000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.0000000003563000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $tq'PING!<Xwormmm>Program Manager<Xwormmm>0Tetqh7V
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>2003543
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $tq-PING!<Xwormmm>Program Manager<Xwormmm>1795112Tetq
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $tq'PING!<Xwormmm>Program Manager<Xwormmm>0Tetqh7[
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $tq-PING!<Xwormmm>Program Manager<Xwormmm>2003543Tetq
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $tq'PING!<Xwormmm>Program Manager<Xwormmm>0Tetqhw\
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>1795112
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $tq'PING!<Xwormmm>Program Manager<Xwormmm>0Tetqh7_
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $tq-PING!<Xwormmm>Program Manager<Xwormmm>2008415Tetq
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\tq@\tq-PING!<Xwormmm>Program Manager<Xwormmm>2008415
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.0000000003563000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035B3000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\tq@\tq'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\tq@\tq-PING!<Xwormmm>Program Manager<Xwormmm>1795112
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.0000000003563000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032D9000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000035B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managert-tq

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Users\user\Desktop\9758xBqgE1azKnB.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Users\user\Desktop\9758xBqgE1azKnB.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Queries volume information: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Queries volume information: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.28.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.28.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.28.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: 9758xBqgE1azKnB.exe, 00000007.00000002.3824966064.0000000001507000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.28.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\9758xBqgE1azKnB.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1753363260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1747690067.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3827541610.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 6912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: grjujyNaBLaKbU.exe PID: 888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: grjujyNaBLaKbU.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7568, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.grjujyNaBLaKbU.exe.2bd2aa4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.grjujyNaBLaKbU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.grjujyNaBLaKbU.exe.2bdbb84.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.9758xBqgE1azKnB.exe.30b13e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.9758xBqgE1azKnB.exe.30a8300.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.9758xBqgE1azKnB.exe.2eb0aac.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.9758xBqgE1azKnB.exe.2eb9b8c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1753363260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1747690067.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3827541610.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 6912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: grjujyNaBLaKbU.exe PID: 888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: grjujyNaBLaKbU.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9758xBqgE1azKnB.exe PID: 7568, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	112 Process Injection	1 Masquerading	1 Input Capture	121 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	112 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9758xBqgE1azKnB.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
9758xBqgE1azKnB.exe	55%	Virustotal		Browse
9758xBqgE1azKnB.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe	55%	Virustotal		Browse
C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe	55%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
18.181.154.24	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
18.181.154.24	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.apache.org/licenses/LICENSE-2.0	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designersG	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/?	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers?	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.tiro.com	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://upx.sf.net	Amcache.hve.28.dr	false	high
http://www.fontbureau.com/designers	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.goodfont.co.kr	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources	9758xBqgE1azKnB.exe, grjujyNaBLaKbU.exe.0.dr, 9758xBqgE1azKnB.exe.7.dr	false	high
http://www.carterandcone.coml	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.typography.netD	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/cabarga.htmlN	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/staff/dennis.htm	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/frere-user.html	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.jiyu-kobo.co.jp/	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers8	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fonts.com	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sandoll.co.kr	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.zhongyicts.com.cn	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	9758xBqgE1azKnB.exe, 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000007.00000002.3827541610.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, grjujyNaBLaKbU.exe, 00000008.00000002.1747690067.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp, 9758xBqgE1azKnB.exe, 00000013.00000002.1908285352.0000000002479000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sakkal.com	9758xBqgE1azKnB.exe, 00000000.00000002.1715832568.00000000071A2000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
18.181.154.24	unknown	United States		16509	AMAZON-02US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562040
Start date and time:	2024-11-25 06:24:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Critical Process Termination
Sample name:	9758xBqgE1azKnB.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@33/21@0/1
EGA Information:	Successful, ratio: 62.5%
HCA Information:	Successful, ratio: 98% Number of executed functions: 469 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 9758xBqgE1azKnB.exe, PID 7700 because it is empty
Execution Graph export aborted for target 9758xBqgE1azKnB.exe, PID 8080 because it is empty
Execution Graph export aborted for target grjujyNaBLaKbU.exe, PID 7400 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:24:57	API Interceptor	6718413x Sleep call for process: 9758xBqgE1azKnB.exe modified
00:24:58	API Interceptor	12x Sleep call for process: powershell.exe modified
00:24:59	API Interceptor	3x Sleep call for process: grjujyNaBLaKbU.exe modified
05:24:59	Task Scheduler	Run new task: grjujyNaBLaKbU path: C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe
05:25:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9758xBqgE1azKnB C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe
05:25:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9758xBqgE1azKnB C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe
05:25:18	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9758xBqgE1azKnB.lnk

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.239.168.24
	file.exe	Get hash	malicious	Credential Flusher	Browse	108.158.75.108
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	3.167.152.14
	https://clever-photos-686127.framer.app/	Get hash	malicious	Unknown	Browse	108.158.75.21
	bin.sh.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	apep.mpsl.elf	Get hash	malicious	Mirai	Browse	54.183.101.83
	apep.spc.elf	Get hash	malicious	Mirai	Browse	52.65.67.33
	apep.m68k.elf	Get hash	malicious	Unknown	Browse	18.183.72.200
	apep.arm6.elf	Get hash	malicious	Mirai	Browse	18.183.140.68
	apep.sh4.elf	Get hash	malicious	Mirai	Browse	54.110.214.164

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_9758xBqgE1azKnB._aa799425bed1b3d36059a0f9e236de6a71257a_3b6de569_a5fee1dc-3513-4561-b22d-7d61e242a063\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2422724671372962
Encrypted:	false
SSDEEP:	192:w4V/vApeM0BU/Ka67Pf4nv5zuiF8Z24IO8/4Yyt:wQvApeHBU/Ka+Yv5zuiF8Y4IO8/ly
MD5:	9503D1308C956667B86BECAEFF5C9607
SHA1:	CAA9E63716080119CA92C8458AE845AFFB9E1E10
SHA-256:	AFF8FAE40097EFF2D0A07B6227BF8264BDA3FA1D7A41F32D6CAE8FD49187F29C
SHA-512:	74AFEAD525FEDE602D7537D49F849EEAABF8892C585A7FB4F5C5C7B8D2E21EF621B58A1B57F427FDB226715D2328F1A98539B809F736F3B7058B645013515BBF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.r.i.t.i.c.a.l.P.r.o.c.e.s.s.F.a.u.l.t.2.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.9.8.6.1.1.0.4.3.9.0.1.6.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.5.f.e.e.1.d.c.-.3.5.1.3.-.4.5.6.1.-.b.2.2.d.-.7.d.6.1.e.2.4.2.a.0.6.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.9.f.3.d.f.4.e.-.1.e.5.0.-.4.8.3.8.-.b.3.6.9.-.a.2.8.1.4.1.0.b.5.6.e.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.7.5.8.x.B.q.g.E.1.a.z.K.n.B...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.N.H.w.E...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.0.0.-.0.0.0.1.-.0.0.1.4.-.f.4.3.1.-.5.1.5.e.f.a.3.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.c.7.b.2.6.5.b.0.d.8.e.a.9.2.d.a.8.9.7.6.9.d.0.f.a.3.5.0.c.4.7.0.0.0.0.0.0.0.0.!.0.0.0.0.f.f.b.e.2.8.4.7.5.9.0.e.8.7.6.8.9.2.b.4.1.5.8.5.7.8.4.b.4.0.1.4.4.c.2.2.4.1.6.0.!.9.7.5.8.x.B.q.g.E.1.a.z.K.n.B...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1BE7.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Nov 25 05:28:30 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	360875
Entropy (8bit):	3.5765657308219025
Encrypted:	false
SSDEEP:	3072:VrwE59WqFylhH5y6/tpM4uEqscAzhAP1uILTgP6:VriqFy7HActS4wAzhx+TgP
MD5:	387F8379D4618D1678CCD5BCDD14552A
SHA1:	2C42FC30799BC7951B590D9CA7CA7831E4C4E5BC
SHA-256:	AF9DD30A706A712D8241A5BE0D167713F614F500C33148419C41E627F2F9E56B
SHA-512:	B6891418435DDFB262C160C61B26E2FE54A230317017B9AB871545815C9B73EF06965B7CA26A9281B2608E15A671A53BC9ECC954B8A8D35A3B6C98566AAF4E05
Malicious:	false
Preview:	MDMP..a..... .........Dg............4...........0"..H.......$...x,.......,...k..........`.......8...........T............I...8...........,..........................................................................................eJ...... /......GenuineIntel............T...........*.Dg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1DCD.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6540
Entropy (8bit):	3.718426231809118
Encrypted:	false
SSDEEP:	192:R6l7wVeJSk6QsYk4jO4kYprM89bNxsf05Pm:R6lXJx6DYkj4kMNqfF
MD5:	798CF570A02E023026EE083EB109FD37
SHA1:	E3899D163A01D45B237ECDE51B85E5E987F87B19
SHA-256:	977A50D956FFE5F57D38D28ECFF2C415B616F12C6A30D4760FC5C1FFE2110034
SHA-512:	FE07C0CD73FB0D0CBF329CDC72BD14D534B0B8FAEA85BFE017F842DE8586F13B5F25AF064BA53C44D71D9FD28299A072217BDDBA1223AD49DBE17A83EFEB1F29
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1DFD.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	4.486273295770891
Encrypted:	false
SSDEEP:	48:cvIwWl8zsOJg77aI90fWpW8VYiYm8M4Jt3FF+q8vRItS3975wd:uIjfEI72O7VWJ9K+S3975wd
MD5:	2C3EE5D70B401041468C06CCE02ED104
SHA1:	EA25A2427EE460CB8D8926CA0243729026237023
SHA-256:	1A91E3B66D9BDC7602AD46BCBE362728151667362F24030D5BA39EB8073D07B5
SHA-512:	5D347CBD96DCCBDF08A6B75B272AA27FB0E157BD95AF34FC8D773F70EC74587DCE12197290C4015077A80D50E0E752AE3932D5EF22911CE5FD728C213735D1D1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="603151" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9758xBqgE1azKnB.exe.log

Process:	C:\Users\user\Desktop\9758xBqgE1azKnB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\grjujyNaBLaKbU.exe.log

Process:	C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379677338874509
Encrypted:	false
SSDEEP:	48:tWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//ZSUyus:tLHxvIIwLgZ2KRHWLOugEs
MD5:	CDD49264DF85EB760D31ACA6C430734F
SHA1:	1EE7B95307CF8A61FA4031F5FAA2EE2EAA98853C
SHA-256:	155727CEC1ED0F44E6D6B68D91027D5FFE2752324B033A6BC4D0759BD4E73812
SHA-512:	9F6B2E807AB4430494BBE31D015F1758C712CB5306B88CDF545DB0890EABB52E140BBB649AD989328146A0594271A1857C02E581DE96504EE673B34D2F38DC24
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\Users\user\Desktop\9758xBqgE1azKnB.exe
File Type:	Generic INItialization configuration [WIN]
Category:	dropped
Size (bytes):	58
Entropy (8bit):	3.598349098128234
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr42VjFYJKXzovX:EFYJKDoWr5FYJKDoP
MD5:	5362ACB758D5B0134C33D457FCC002D9
SHA1:	BC56DFFBE17C015DB6676CF56996E29DF426AB92
SHA-256:	13229E0AD721D53BF9FB50FA66AE92C6C48F2ABB785F9E17A80E224E096028A4
SHA-512:	3FB6DA9993FBFC1DC3204DC2529FB7D9C6FE4E6F06E6C8E2DC0BE05CD0E990ED2643359F26EC433087C1A54C8E1C87D02013413CE8F4E1A6D2F380BE0F5EB09B
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]....### explorer ###..r

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mrao0pob.vfp.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ptanzkqs.3if.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tzb2yt1e.22j.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xtganllf.awn.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp21F.tmp

Process:	C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.117777286684185
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta2xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTzv
MD5:	F659B281A1724D379D187BF4921815E0
SHA1:	0C82F950FD6882B140668C582FBE26E24D435EF9
SHA-256:	D9D9C8608F7EAAA9EEBB8BF106EB2B3CA6B5D10DB6654C8E7837384B4209EB67
SHA-512:	890317690A04FAA4F19B0A8D68EBE055D203E50289B3BC60B90DAFBECA30E33359575B6AB74AD9897D68530EB690106F7A856D1735C541ADB2E176EE4351239F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpAD87.tmp

Process:	C:\Users\user\Desktop\9758xBqgE1azKnB.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.117777286684185
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta2xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTzv
MD5:	F659B281A1724D379D187BF4921815E0
SHA1:	0C82F950FD6882B140668C582FBE26E24D435EF9
SHA-256:	D9D9C8608F7EAAA9EEBB8BF106EB2B3CA6B5D10DB6654C8E7837384B4209EB67
SHA-512:	890317690A04FAA4F19B0A8D68EBE055D203E50289B3BC60B90DAFBECA30E33359575B6AB74AD9897D68530EB690106F7A856D1735C541ADB2E176EE4351239F
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpBA0A.tmp

Process:	C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.117777286684185
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta2xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTzv
MD5:	F659B281A1724D379D187BF4921815E0
SHA1:	0C82F950FD6882B140668C582FBE26E24D435EF9
SHA-256:	D9D9C8608F7EAAA9EEBB8BF106EB2B3CA6B5D10DB6654C8E7837384B4209EB67
SHA-512:	890317690A04FAA4F19B0A8D68EBE055D203E50289B3BC60B90DAFBECA30E33359575B6AB74AD9897D68530EB690106F7A856D1735C541ADB2E176EE4351239F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpE11A.tmp

Process:	C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.117777286684185
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta2xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTzv
MD5:	F659B281A1724D379D187BF4921815E0
SHA1:	0C82F950FD6882B140668C582FBE26E24D435EF9
SHA-256:	D9D9C8608F7EAAA9EEBB8BF106EB2B3CA6B5D10DB6654C8E7837384B4209EB67
SHA-512:	890317690A04FAA4F19B0A8D68EBE055D203E50289B3BC60B90DAFBECA30E33359575B6AB74AD9897D68530EB690106F7A856D1735C541ADB2E176EE4351239F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe

Process:	C:\Users\user\Desktop\9758xBqgE1azKnB.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	450048
Entropy (8bit):	7.90029136666667
Encrypted:	false
SSDEEP:	6144:ucNDV2oul+zXcaE1RvqWacCBlDTTUwGIoYX27kbkbBkXaqZgLSdD+cQXI2j+Jz7z:ucNDo7ZpaFbcSi7HbGpgLgOXI2jkXZ1
MD5:	BF7866489443A237806A4D3D5701CDF3
SHA1:	FFBE2847590E876892B41585784B40144C224160
SHA-256:	1070BF3C0F917624660BEF57D24E6B2CF982DCE067E95EB8A041586C0F41A095
SHA-512:	E9BB9D5157D2011EED5F5013AF4145877E3237DEF266F2CC6FD769ED7065A4FA227F7D316DE5FC7EEAE8F3F852B685FB3CC166127F79134F1FA1A200B8C0C186
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58% Antivirus: Virustotal, Detection: 55%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."(<g..............0.............V.... ........@.. .......................@............@.....................................O.......L.................... ..........T............................................ ............... ..H............text...\.... ...................... ..`.rsrc...L...........................@..@.reloc....... ......................@..B................6.......H........}...O......i....................................................0..$..........s......s.....s ......o!...&..+...0..)........s\....s.......o[...s......o".......+.......0..+........s\....r...p.(#......o[...s......o$....+....0..0........s\....rC..p.r...p(%......o[...s......o$....+...0...........s\.......O...%.r...p.%...%.r...p.%...%.r...p.%....%.r!..p.%....%.r;..p.%.....%..rU..p.%.....%..ry..p.%....%..r...p.(&......o[...s.......o$...&r...p('...&......o(...('...&...*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9758xBqgE1azKnB.lnk

Process:	C:\Users\user\Desktop\9758xBqgE1azKnB.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Mon Nov 25 04:25:02 2024, mtime=Mon Nov 25 04:25:03 2024, atime=Mon Nov 25 04:25:03 2024, length=450048, window=hide
Category:	dropped
Size (bytes):	806
Entropy (8bit):	5.106269322557677
Encrypted:	false
SSDEEP:	12:8BlC8m8ZCM4LuSWCbdY//8xSLnmi8TSjEjABrH+ifp4TBmV:8zQuY+UW3hQABy3TBm
MD5:	C22CE3514EB3ADF537C8EB8AEFEF0620
SHA1:	70CDDB00F18F88668F5CE5F59D892908D50D9346
SHA-256:	D00885E42B2430E817CA1884600DC35E97BB72D8B410728B7BA522D43D14BE75
SHA-512:	25F4A8C7A04D14B1C3A6D7BDAC974E841B9B86D0A1F1122746CAB937BD6BADD6757F0543210CEA619EA3B74B1127F39B2F8596282FA76015ABBFFCCF3FBFC1D5
Malicious:	false
Preview:	L..................F.... ...X..`.>...da.>...da.>............................:..DG..Yr?.D..U..k0.&...&......vk.v....L}>Y.>....pa.>......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^yY.+...........................%..A.p.p.D.a.t.a...B.V.1.....yY.+..Roaming.@......CW.^yY.+..........................b.0.R.o.a.m.i.n.g.....t.2.....yY"+ .9758XB~1.EXE..X......yY"+yY"+............................W.9.7.5.8.x.B.q.g.E.1.a.z.K.n.B...e.x.e.......a...............-.......`...........P`.d.....C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe..".....\.....\.....\.....\.....\.9.7.5.8.x.B.q.g.E.1.a.z.K.n.B...e.x.e.`.......X.......302494...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe

Process:	C:\Users\user\Desktop\9758xBqgE1azKnB.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	450048
Entropy (8bit):	7.90029136666667
Encrypted:	false
SSDEEP:	6144:ucNDV2oul+zXcaE1RvqWacCBlDTTUwGIoYX27kbkbBkXaqZgLSdD+cQXI2j+Jz7z:ucNDo7ZpaFbcSi7HbGpgLgOXI2jkXZ1
MD5:	BF7866489443A237806A4D3D5701CDF3
SHA1:	FFBE2847590E876892B41585784B40144C224160
SHA-256:	1070BF3C0F917624660BEF57D24E6B2CF982DCE067E95EB8A041586C0F41A095
SHA-512:	E9BB9D5157D2011EED5F5013AF4145877E3237DEF266F2CC6FD769ED7065A4FA227F7D316DE5FC7EEAE8F3F852B685FB3CC166127F79134F1FA1A200B8C0C186
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58% Antivirus: Virustotal, Detection: 55%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."(<g..............0.............V.... ........@.. .......................@............@.....................................O.......L.................... ..........T............................................ ............... ..H............text...\.... ...................... ..`.rsrc...L...........................@..@.reloc....... ......................@..B................6.......H........}...O......i....................................................0..$..........s......s.....s ......o!...&..+...0..)........s\....s.......o[...s......o".......+.......0..+........s\....r...p.(#......o[...s......o$....+....0..0........s\....rC..p.r...p(%......o[...s......o$....+...0...........s\.......O...%.r...p.%...%.r...p.%...%.r...p.%....%.r!..p.%....%.r;..p.%.....%..rU..p.%.....%..ry..p.%....%..r...p.(&......o[...s.......o$...&r...p('...&......o(...('...&...*.

C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\9758xBqgE1azKnB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46583317555289
Encrypted:	false
SSDEEP:	6144:YIXfpi67eLPU9skLmb0b4BWSPKaJG8nAgejZMMhA2gX4WABl0uNNdwBCswSbU:NXD94BWlLZMM6YFHr+U
MD5:	8241812D351C515A1C514F8B0FB8F05E
SHA1:	65054D06CC9F5191B4D3C6C7AD5E290895B4CFE0
SHA-256:	74C0720D36D916D7D3A30C8367409113C1C9EDC7FA0E5B0CD8BCFCF211681E65
SHA-512:	7DD8B8DBCCD563344046F9D2E20488A5F4F8D8844DE00656571D1D67332C5F8DAE6270BF4C0BD0340C7B3A5B9245E9D7F307064D148FB8BCFCD6447ECF667151
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....>..............................................................................................................................................................................................................................................................................................................................................ZG..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.90029136666667
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	9758xBqgE1azKnB.exe
File size:	450'048 bytes
MD5:	bf7866489443a237806a4d3d5701cdf3
SHA1:	ffbe2847590e876892b41585784b40144c224160
SHA256:	1070bf3c0f917624660bef57d24e6b2cf982dce067e95eb8a041586c0f41a095
SHA512:	e9bb9d5157d2011eed5f5013af4145877e3237def266f2cc6fd769ed7065a4fa227f7d316de5fc7eeae8f3f852b685fb3cc166127f79134f1fa1a200b8c0c186
SSDEEP:	6144:ucNDV2oul+zXcaE1RvqWacCBlDTTUwGIoYX27kbkbBkXaqZgLSdD+cQXI2j+Jz7z:ucNDo7ZpaFbcSi7HbGpgLgOXI2jkXZ1
TLSH:	5FA4029062AC8FBBE0BD9FF26166B05027F6396F2421F24D5FC261DD296AF006350B57
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."(<g..............0.............V.... ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x46f056
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673C2822 [Tue Nov 19 05:54:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6f002	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x64c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x72000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6cf00	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6d05c	0x6d200	f364872a41e4bf9fc09cdf5f01041c39	False	0.9330747064719358	data	7.9146348506405895	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x64c	0x800	cbc4a37c85e29bb1836ef7fda56f9d3f	False	0.34228515625	data	3.5159313995256327	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x72000	0xc	0x200	711c25bdf113b2ff00e49977e3c95b33	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x70090	0x3bc	data			0.41527196652719667
RT_MANIFEST	0x7045c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T06:25:13.034497+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:25:13.034497+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:25:15.971536+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49735	18.181.154.24	7000	TCP
2024-11-25T06:25:43.034632+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:25:43.034632+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:26:13.077926+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:26:13.077926+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:26:18.498577+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49735	18.181.154.24	7000	TCP
2024-11-25T06:26:43.062445+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:26:43.062445+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:27:13.042930+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:27:13.042930+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:27:43.059424+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:27:43.059424+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:28:13.069282+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	18.181.154.24	7000	192.168.2.4	49735	TCP
2024-11-25T06:28:13.069282+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	18.181.154.24	7000	192.168.2.4	49735	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 06:25:04.539885998 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:25:04.660733938 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:25:04.660821915 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:25:04.789459944 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:25:04.908958912 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:25:13.034497023 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:25:13.078707933 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:25:15.971535921 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:25:16.091023922 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:25:27.157812119 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:25:27.277409077 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:25:38.328963995 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:25:38.449665070 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:25:43.034631968 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:25:43.079014063 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:25:49.500915051 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:25:49.620454073 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:00.672759056 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:00.793092012 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:11.843012094 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:11.962661982 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:12.501064062 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:12.621624947 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:13.077925920 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:13.125720024 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:13.910507917 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:14.030282974 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:14.236398935 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:14.355921984 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:15.465199947 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:15.584654093 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:17.013791084 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:17.134289026 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:17.639235020 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:17.758727074 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:18.328562975 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:18.448131084 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:18.498577118 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:18.618113041 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:18.919617891 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:19.039146900 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:20.376848936 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:20.496408939 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:20.594681978 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:20.714198112 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:20.948312998 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:21.068171978 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:22.202737093 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:22.322249889 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:23.250905037 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:23.370415926 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:23.480904102 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:23.600447893 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:23.842911005 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:23.962388992 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:24.495065928 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:24.614653111 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:24.641725063 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:24.761255980 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:24.899239063 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:25.018928051 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:26.370874882 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:26.490319967 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:26.579186916 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:26.698949099 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:27.121141911 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:27.240650892 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:28.501075983 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:28.620534897 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:28.620579958 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:28.740019083 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:28.740065098 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:28.859523058 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:28.861455917 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:28.980885029 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:29.391524076 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:29.510940075 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:29.510997057 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:29.630549908 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:30.092673063 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:30.212223053 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:30.453452110 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:30.572977066 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:30.573040009 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:30.692529917 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:30.996746063 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:31.116173983 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:31.116225004 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:31.235692024 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:31.972037077 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:32.091836929 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:32.767123938 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:32.886625051 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:33.783098936 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:33.902551889 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:34.650451899 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:34.769946098 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:35.768724918 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:35.888187885 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:36.552536964 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:36.672039032 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:36.717119932 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:36.836565971 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:38.337352037 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:38.456907988 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:38.762598038 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:38.882169008 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:39.146228075 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:39.265671015 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:40.384027958 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:40.503541946 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:41.844691992 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:41.964189053 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:42.711765051 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:42.831217051 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:42.846760035 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:42.966232061 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:43.062444925 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:43.126116991 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:45.744128942 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:45.864340067 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:49.010361910 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:49.129796028 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:49.406291008 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:49.525752068 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:50.040954113 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:50.160837889 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:50.276277065 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:50.395672083 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:52.738598108 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:52.860261917 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:53.424002886 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:53.544265032 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:53.561726093 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:53.681238890 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:53.706079006 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:53.825586081 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:53.964457989 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:54.083878994 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:54.417567968 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:54.536988974 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:54.618047953 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:54.737500906 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:55.388859034 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:55.508281946 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:55.508393049 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:55.813292027 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:55.836466074 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:55.897330999 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:55.932910919 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:56.016765118 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:56.016824007 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:56.136240005 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:56.766634941 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:56.886209011 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:56.948126078 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:57.067743063 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:57.414226055 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:57.533710957 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:58.366482973 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:58.485866070 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:58.485912085 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:58.605340958 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:58.768022060 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:58.887502909 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:58.887557983 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:59.007131100 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:59.020275116 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:59.139872074 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:26:59.139919043 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:26:59.259398937 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:01.094100952 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:01.213643074 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:01.213692904 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:01.333286047 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:02.330389023 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:02.449914932 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:02.450102091 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:02.569600105 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:03.129297972 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:03.248832941 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:03.249013901 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:03.368527889 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:04.333843946 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:04.453485012 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:04.453530073 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:04.573137045 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:04.710663080 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:04.830426931 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:04.906608105 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:05.026051998 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:06.630211115 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:06.749717951 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:06.956479073 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:07.076184034 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:07.115693092 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:07.236215115 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:08.283662081 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:08.403295994 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:08.403350115 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:08.522860050 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:08.522924900 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:08.645967007 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:08.752549887 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:08.872035980 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:08.872078896 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:08.991542101 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:09.028405905 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:09.147924900 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:10.352473021 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:10.472038031 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:10.531306028 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:10.650813103 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:10.692250013 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:10.813982964 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:13.042929888 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:13.096208096 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:13.216098070 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:13.240355968 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:13.360207081 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:14.506359100 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:14.625860929 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:14.625900030 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:14.745337009 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:16.891777992 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:17.011197090 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:17.011259079 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:17.130747080 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:17.245749950 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:17.365287066 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:18.374696970 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:18.494266033 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:18.745460987 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:18.865112066 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:18.865169048 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:18.984832048 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:18.984903097 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:19.104679108 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:20.666589975 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:20.786058903 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:20.786101103 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:20.905550957 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:21.101103067 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:21.220732927 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:21.220774889 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:21.340328932 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:21.340415001 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:21.459923029 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:22.301995993 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:22.421478987 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:22.421569109 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:22.541057110 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:24.278655052 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:24.398171902 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:24.401694059 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:24.521202087 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:24.521275043 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:24.640721083 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:24.640789986 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:24.760361910 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:24.760438919 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:24.879885912 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:25.376178026 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:25.495759964 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:26.404266119 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:26.523719072 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:26.523768902 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:26.643388033 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:26.643435955 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:26.762876987 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:26.762945890 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:26.884213924 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:28.404161930 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:28.523662090 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:28.523714066 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:28.643177986 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:28.643228054 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:28.762819052 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:28.775510073 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:28.895131111 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:28.895237923 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:29.014756918 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:29.216566086 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:29.336024046 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:30.342334986 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:30.461853027 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:30.471885920 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:30.592156887 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:31.204499006 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:31.326035023 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:32.298310995 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:32.417965889 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:32.418014050 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:32.537478924 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:34.753030062 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:34.872560978 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:35.152327061 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:35.272381067 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:35.272430897 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:35.393043041 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:36.394630909 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:36.514101028 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:37.150705099 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:37.270358086 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:37.270396948 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:37.389918089 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:40.033132076 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:40.152755022 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:40.400119066 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:40.520629883 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:40.520737886 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:40.640402079 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:40.969315052 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:41.088823080 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:41.977132082 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:42.096674919 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:42.336674929 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:42.456234932 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:42.851722956 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:42.971179008 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:43.059423923 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:43.125880957 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:47.576018095 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:47.695501089 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:47.978082895 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:48.097645998 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:48.097744942 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:48.217261076 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:49.551419973 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:49.670909882 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:49.670955896 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:49.790515900 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:50.125859022 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:50.245404005 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:51.390902996 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:51.510364056 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:51.897392988 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:52.016907930 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:52.017178059 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:52.136797905 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:52.671328068 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:52.790774107 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:54.198834896 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:54.318547964 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:55.359451056 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:55.478974104 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:55.526082039 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:55.645787954 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:55.645837069 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:55.765376091 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:57.047965050 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:57.167454958 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:57.491758108 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:57.611249924 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:58.707829952 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:58.827595949 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:58.827652931 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:58.947216988 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:27:58.947257996 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:27:59.066940069 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:00.117614031 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:00.237384081 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:01.100861073 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:01.220376015 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:01.805645943 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:01.925154924 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:02.460979939 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:02.580576897 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:06.533147097 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:06.652769089 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:08.126241922 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:08.245831966 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:08.466020107 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:08.585542917 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:08.592597961 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:08.712065935 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:10.429256916 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:10.548808098 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:10.548856020 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:10.668309927 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:10.668355942 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:10.788639069 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:11.061686039 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:11.182142973 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:11.182198048 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:11.301657915 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:11.301707983 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:11.421624899 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:11.427418947 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:11.546886921 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:11.970057011 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:12.089894056 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:12.686772108 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:12.806337118 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:12.806505919 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:12.926009893 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:13.069282055 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:13.126064062 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:14.463332891 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:14.583353996 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:15.755742073 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:15.875327110 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:16.705473900 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:16.825056076 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:16.827461004 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:16.947004080 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:20.411338091 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:20.531065941 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:20.807631016 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:20.927356958 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:20.927406073 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:21.046868086 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:22.872056007 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:22.991636038 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:23.751351118 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:23.870906115 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:24.131230116 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:24.250911951 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:24.432094097 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:24.551695108 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:24.601260900 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:24.848011971 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:24.848088026 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:24.968420982 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:26.498641014 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:26.619112968 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:26.927558899 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:27.047096014 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:28.487765074 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:28.607436895 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:28.607481956 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:28.727098942 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:28.727140903 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:28.846678972 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:29.351336002 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:29.471000910 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:30.553886890 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:30.922863007 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:30.964472055 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:30.964523077 CET	49735	7000	192.168.2.4	18.181.154.24
Nov 25, 2024 06:28:31.042380095 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:31.084222078 CET	7000	49735	18.181.154.24	192.168.2.4
Nov 25, 2024 06:28:33.428558111 CET	49735	7000	192.168.2.4	18.181.154.24

Target ID:	0
Start time:	00:24:56
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\9758xBqgE1azKnB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\9758xBqgE1azKnB.exe"
Imagebase:	0xbd0000
File size:	450'048 bytes
MD5 hash:	BF7866489443A237806A4D3D5701CDF3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1714031582.000000000309C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	00:24:57
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"
Imagebase:	0x4f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	00:24:57
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	00:24:57
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpAD87.tmp"
Imagebase:	0x440000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	00:24:57
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	00:24:58
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\9758xBqgE1azKnB.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\9758xBqgE1azKnB.exe"
Imagebase:	0xc0000
File size:	450'048 bytes
MD5 hash:	BF7866489443A237806A4D3D5701CDF3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	00:24:58
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\9758xBqgE1azKnB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\9758xBqgE1azKnB.exe"
Imagebase:	0xef0000
File size:	450'048 bytes
MD5 hash:	BF7866489443A237806A4D3D5701CDF3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000007.00000002.3827541610.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	00:24:59
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe
Imagebase:	0x7b0000
File size:	450'048 bytes
MD5 hash:	BF7866489443A237806A4D3D5701CDF3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000008.00000002.1747690067.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000008.00000002.1747690067.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs Detection: 55%, Virustotal, Browse
Reputation:	low
Has exited:	true

Target ID:	9
Start time:	00:24:59
Start date:	25/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	00:25:01
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpBA0A.tmp"
Imagebase:	0x440000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	00:25:01
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	00:25:01
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"
Imagebase:	0x160000
File size:	450'048 bytes
MD5 hash:	BF7866489443A237806A4D3D5701CDF3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	00:25:01
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\grjujyNaBLaKbU.exe"
Imagebase:	0xae0000
File size:	450'048 bytes
MD5 hash:	BF7866489443A237806A4D3D5701CDF3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000D.00000002.1753363260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000D.00000002.1753363260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	14
Start time:	00:25:10
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Imagebase:	0xa80000
File size:	450'048 bytes
MD5 hash:	BF7866489443A237806A4D3D5701CDF3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000E.00000002.1850299737.0000000002E55000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs Detection: 55%, Virustotal, Browse
Reputation:	low
Has exited:	true

Target ID:	15
Start time:	00:25:11
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmpE11A.tmp"
Imagebase:	0x440000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	00:25:11
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	00:25:11
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Imagebase:	0xdb0000
File size:	450'048 bytes
MD5 hash:	BF7866489443A237806A4D3D5701CDF3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	00:25:18
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Imagebase:	0x1e0000
File size:	450'048 bytes
MD5 hash:	BF7866489443A237806A4D3D5701CDF3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	22
Start time:	00:25:19
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grjujyNaBLaKbU" /XML "C:\Users\user\AppData\Local\Temp\tmp21F.tmp"
Imagebase:	0x440000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	00:25:19
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	24
Start time:	00:25:19
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\9758xBqgE1azKnB.exe"
Imagebase:	0x720000
File size:	450'048 bytes
MD5 hash:	BF7866489443A237806A4D3D5701CDF3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	28
Start time:	00:28:30
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 1852
Imagebase:	0x180000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true