Windows Analysis Report
Remittance 18042024.doc

Overview

General Information

Sample name: Remittance 18042024.doc
Analysis ID: 1427892
MD5: 36fd7195da0b7562c04ba8e3f055e6fb
SHA1: dac1a451343920a8591606f34d1e04872dcb1ba1
SHA256: fed5aa29002c173014320d6fd24304d0bd94089c51a06d06e35a66eef84908c1
Tags: doc
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Installs a global keyboard hook
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Microsoft Office Child Process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Powershell Defender Exclusion
Sigma detected: SCR File Write Event
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Suspicious Screensaver Binary File Creation
Stores large binary data to the registry
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Remittance 18042024.doc ReversingLabs: Detection: 36%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\H8w3nxJQ4Gya5ED[1].scr Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Joe Sandbox ML: detected

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 172.67.134.136 Port: 443 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 172.67.134.136:443 -> 192.168.2.22:49163 version: TLS 1.2

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: dukeenergyltd.top
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 172.67.134.136:443
Source: global traffic TCP traffic: 172.67.134.136:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.199.225:587
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.199.225:587
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.199.225:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.199.225:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170

Networking
barindex
Yara detected Generic Downloader
Source: Yara match File source: 12.2.dzmjjohohj75.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.32ad150.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3fd51e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3f999c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, type: UNPACKEDPE
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.199.225:587
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View IP Address: 208.91.199.225 208.91.199.225
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe DNS query: name: ip-api.com
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.199.225:587
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /H8w3nxJQ4Gya5ED.scr HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: dukeenergyltd.topConnection: Keep-Alive
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{97E9E64F-3B5C-42D6-91A0-CA9C348242D5}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /H8w3nxJQ4Gya5ED.scr HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: dukeenergyltd.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: unknown DNS traffic detected: queries for: dukeenergyltd.top
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000002.00000002.350082387.000000000029C000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.350082387.0000000000322000.00000004.00000020.00020000.00000000.sdmp, dzmjjohohj75.scr, 00000005.00000002.369271178.00000000051E7000.00000004.00000020.00020000.00000000.sdmp, H8w3nxJQ4Gya5ED[1].scr.2.dr, dzmjjohohj75.scr.2.dr, JnhNjrgJxHWJu.exe.5.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: EQNEDT32.EXE, 00000002.00000002.350082387.000000000029C000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.350082387.0000000000322000.00000004.00000020.00020000.00000000.sdmp, dzmjjohohj75.scr, 00000005.00000002.369271178.00000000051E7000.00000004.00000020.00020000.00000000.sdmp, H8w3nxJQ4Gya5ED[1].scr.2.dr, dzmjjohohj75.scr.2.dr, JnhNjrgJxHWJu.exe.5.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: dzmjjohohj75.scr, 00000005.00000002.366840352.0000000003271000.00000004.00000800.00020000.00000000.sdmp, dzmjjohohj75.scr, 0000000C.00000002.617849885.00000000022D1000.00000004.00000800.00020000.00000000.sdmp, dzmjjohohj75.scr, 0000000C.00000002.616660111.0000000000430000.00000040.00000400.00020000.00000000.sdmp, JnhNjrgJxHWJu.exe, 0000000E.00000002.389323917.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, JnhNjrgJxHWJu.exe, 00000015.00000002.617842734.0000000002491000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.350082387.000000000029C000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.350082387.0000000000322000.00000004.00000020.00020000.00000000.sdmp, dzmjjohohj75.scr, 00000005.00000002.369271178.00000000051E7000.00000004.00000020.00020000.00000000.sdmp, H8w3nxJQ4Gya5ED[1].scr.2.dr, dzmjjohohj75.scr.2.dr, JnhNjrgJxHWJu.exe.5.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: dzmjjohohj75.scr, 00000005.00000002.366275824.00000000022AB000.00000004.00000800.00020000.00000000.sdmp, dzmjjohohj75.scr, 0000000C.00000002.617849885.00000000022D1000.00000004.00000800.00020000.00000000.sdmp, JnhNjrgJxHWJu.exe, 0000000E.00000002.388463740.000000000250A000.00000004.00000800.00020000.00000000.sdmp, JnhNjrgJxHWJu.exe, 00000015.00000002.617842734.0000000002491000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: dzmjjohohj75.scr, 00000005.00000002.366840352.0000000003271000.00000004.00000800.00020000.00000000.sdmp, dzmjjohohj75.scr, 0000000C.00000002.616660111.0000000000430000.00000040.00000400.00020000.00000000.sdmp, JnhNjrgJxHWJu.exe, 0000000E.00000002.389323917.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: EQNEDT32.EXE, 00000002.00000002.350082387.000000000029C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dukeenergyltd.top/
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.350082387.000000000026F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.350082387.000000000029C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dukeenergyltd.top/H8w3nxJQ4Gya5ED.scr
Source: EQNEDT32.EXE, 00000002.00000002.350082387.000000000029C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dukeenergyltd.top/H8w3nxJQ4Gya5ED.scrC:
Source: EQNEDT32.EXE, 00000002.00000002.350082387.000000000026F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dukeenergyltd.top/H8w3nxJQ4Gya5ED.scrJ;6JCh
Source: EQNEDT32.EXE, 00000002.00000002.350082387.000000000026F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dukeenergyltd.top/H8w3nxJQ4Gya5ED.scrj
Source: EQNEDT32.EXE, 00000002.00000002.350082387.000000000026F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dukeenergyltd.top/H8w3nxJQ4Gya5ED.scrttC:
Source: dzmjjohohj75.scr, 00000005.00000002.369271178.00000000051E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comod
Source: EQNEDT32.EXE, 00000002.00000002.350082387.00000000002E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: EQNEDT32.EXE, 00000002.00000002.350082387.000000000029C000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.350082387.0000000000322000.00000004.00000020.00020000.00000000.sdmp, dzmjjohohj75.scr, 00000005.00000002.369271178.00000000051E7000.00000004.00000020.00020000.00000000.sdmp, H8w3nxJQ4Gya5ED[1].scr.2.dr, dzmjjohohj75.scr.2.dr, JnhNjrgJxHWJu.exe.5.dr String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: unknown Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown HTTPS traffic detected: 172.67.134.136:443 -> 192.168.2.22:49163 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, cPKWk.cs .Net Code: AarPpyo
Installs a global keyboard hook
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Window created: window name: CLIPBRDWNDCLASS

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Remittance 18042024.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 14.2.JnhNjrgJxHWJu.exe.3f999c0.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.dzmjjohohj75.scr.32ad150.6.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.dzmjjohohj75.scr.3271930.8.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.dzmjjohohj75.scr.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.JnhNjrgJxHWJu.exe.3fd51e0.4.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.dzmjjohohj75.scr.32ad150.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.JnhNjrgJxHWJu.exe.3fd51e0.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.JnhNjrgJxHWJu.exe.3f999c0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable editing") from the yellow bar aboveASSIGNMENTMCS 473: MARKETING MANAGEMENT & STRATEGYSTUDENT
.NET source code contains very large array initializations
Source: 5.2.dzmjjohohj75.scr.460000.0.raw.unpack, SQL.cs Large array initialization: : array initializer size 33608
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\H8w3nxJQ4Gya5ED[1].scr Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001DD901 5_2_001DD901
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001D1190 5_2_001D1190
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001DC220 5_2_001DC220
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001DCA98 5_2_001DCA98
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001DB3C0 5_2_001DB3C0
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001DE7C0 5_2_001DE7C0
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001DC188 5_2_001DC188
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001DD368 5_2_001DD368
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001DF660 5_2_001DF660
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001DB700 5_2_001DB700
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006F1B00 5_2_006F1B00
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006F1E08 5_2_006F1E08
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006FB168 5_2_006FB168
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006F4298 5_2_006F4298
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006FB5A0 5_2_006FB5A0
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006FB590 5_2_006FB590
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006FC688 5_2_006FC688
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006F0700 5_2_006F0700
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006F1AF0 5_2_006F1AF0
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006FBA88 5_2_006FBA88
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006F0A80 5_2_006F0A80
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006F2CC0 5_2_006F2CC0
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_006FAD30 5_2_006FAD30
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_002C4070 12_2_002C4070
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_002C3928 12_2_002C3928
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_002C4940 12_2_002C4940
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_002CF3B0 12_2_002CF3B0
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_002CBCCA 12_2_002CBCCA
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_002C89FC 12_2_002C89FC
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_002CA60A 12_2_002CA60A
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_002CBF88 12_2_002CBF88
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_003F6550 12_2_003F6550
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_003F0580 12_2_003F0580
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_003F51F1 12_2_003F51F1
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_003F1640 12_2_003F1640
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_003F8778 12_2_003F8778
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_002DD901 14_2_002DD901
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_002D11BA 14_2_002D11BA
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_002DC220 14_2_002DC220
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_002DCA98 14_2_002DCA98
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_002DE7C0 14_2_002DE7C0
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_002DC188 14_2_002DC188
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_002DD362 14_2_002DD362
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_002DF660 14_2_002DF660
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_002DB700 14_2_002DB700
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_00484708 14_2_00484708
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_00487989 14_2_00487989
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_00481B00 14_2_00481B00
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_00481E08 14_2_00481E08
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_0048B168 14_2_0048B168
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_00488108 14_2_00488108
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_00484298 14_2_00484298
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_0048B590 14_2_0048B590
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_0048B5A0 14_2_0048B5A0
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_0048C688 14_2_0048C688
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_00480700 14_2_00480700
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_00481AF0 14_2_00481AF0
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_0048BA88 14_2_0048BA88
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_00480A80 14_2_00480A80
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_00482CC0 14_2_00482CC0
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_0048AD30 14_2_0048AD30
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 21_2_00344070 21_2_00344070
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 21_2_00348878 21_2_00348878
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 21_2_00343928 21_2_00343928
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 21_2_00344940 21_2_00344940
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 21_2_0034F3B0 21_2_0034F3B0
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 21_2_0034BBC8 21_2_0034BBC8
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 21_2_0034E298 21_2_0034E298
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 21_2_003E6550 21_2_003E6550
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 21_2_003E0580 21_2_003E0580
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 21_2_003E51F1 21_2_003E51F1
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 21_2_003E1640 21_2_003E1640
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 21_2_003E8778 21_2_003E8778
Document contains embedded VBA macros
Source: tmp516B.tmp.5.dr OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: tmp516B.tmp.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Yara signature match
Source: Remittance 18042024.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 14.2.JnhNjrgJxHWJu.exe.3f999c0.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.dzmjjohohj75.scr.32ad150.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.dzmjjohohj75.scr.3271930.8.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.dzmjjohohj75.scr.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.JnhNjrgJxHWJu.exe.3fd51e0.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.dzmjjohohj75.scr.32ad150.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.JnhNjrgJxHWJu.exe.3fd51e0.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.JnhNjrgJxHWJu.exe.3f999c0.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: H8w3nxJQ4Gya5ED[1].scr.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: dzmjjohohj75.scr.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: JnhNjrgJxHWJu.exe.5.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, cPs8D.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, 72CF8egH.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, G5CXsdn.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, 3uPsILA6U.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, 6oQOw74dfIt.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, aMIWm.cs Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, 3QjbQ514BDx.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, 3QjbQ514BDx.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, VRDYqbQsprfc7tIEJf.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, svduIarRUMutChpRyD.cs Security API names: _0020.SetAccessControl
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, svduIarRUMutChpRyD.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, svduIarRUMutChpRyD.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winDOC@24/22@274/5
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$mittance 18042024.doc Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Mutant created: \Sessions\1\BaseNamedObjects\oTiaLqgmXFHztPnsOxQP
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR696C.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................l..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n.......................\..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................\.......(..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.`.......C..........................s.................... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......T..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......o..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s....................$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................\..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......8..........................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................M..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................`.......i..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......|..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................:..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................a..........................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n..........................................................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1....................................s............H....... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s............H.......$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................. .........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................. .........................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............H.......2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................7 .........................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................I .........................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................U .........................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............................g .........................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................s .........................s............H............................... Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Console Write: ................ .......................(.P.....l............................................................................................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,........5.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,........5.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,........5.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,........5.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,........5.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,........5.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n.......D.......T.......,........5.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,........6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.,........6.........................s.................... .......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,........6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,.......26.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,.......>6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....Q6.........................s....................$.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,.......]6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,.......o6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,.......}6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T.......,........6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T................6.........................s....................l.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T................6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....D.......T................6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....D.......T................6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................:<.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................F<.........................s..............O.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................X<.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................d<.........................s..............O.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................w<.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................<.........................s..............O.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n................................<.........................s..............O.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................|........<.........................s..............O.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.|........<.........................s..............O..... .......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................<.........................s..............O.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................<.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................<.........................s..............O.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......<.........................s..............O.....$.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................=.........................s..............O.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................=.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................(=.........................s..............O.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s..............O.....2.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................|.......G=.........................s..............O.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................|.......Z=.........................s....................l.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................|.......f=.........................s..............O.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................|.......x=.........................s..............O.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................=.........................s..............O.............................
Source: C:\Windows\SysWOW64\schtasks.exe Console Write: ................................E.R.R.O.R.:. ...........,...............&:........................................&.............................
Source: C:\Windows\SysWOW64\schtasks.exe Console Write: ................................E.R.R.O.(.P.............,...............,:..............................................j.......................
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: Remittance 18042024.doc ReversingLabs: Detection: 36%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr "C:\Users\user\AppData\Roaming\dzmjjohohj75.scr"
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzmjjohohj75.scr"
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JnhNjrgJxHWJu" /XML "C:\Users\user\AppData\Local\Temp\tmp516B.tmp"
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr "C:\Users\user\AppData\Roaming\dzmjjohohj75.scr"
Source: unknown Process created: C:\Windows\System32\taskeng.exe taskeng.exe {B02D7001-C906-48BD-BD62-54916033740A} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe Process created: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JnhNjrgJxHWJu" /XML "C:\Users\user\AppData\Local\Temp\tmp69FA.tmp"
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr "C:\Users\user\AppData\Roaming\dzmjjohohj75.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzmjjohohj75.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JnhNjrgJxHWJu" /XML "C:\Users\user\AppData\Local\Temp\tmp516B.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr "C:\Users\user\AppData\Roaming\dzmjjohohj75.scr" Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process created: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JnhNjrgJxHWJu" /XML "C:\Users\user\AppData\Local\Temp\tmp69FA.tmp"
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: credssp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ncrypt.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: bcrypt.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\taskeng.exe Section loaded: wevtapi.dll
Source: C:\Windows\System32\taskeng.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\taskeng.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\taskeng.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\taskeng.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: wbemcomn2.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Section loaded: windowscodecs.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: Remittance 18042024.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\Remittance 18042024.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, svduIarRUMutChpRyD.cs .Net Code: O5hkj98FYi System.Reflection.Assembly.Load(byte[])
Source: 5.2.dzmjjohohj75.scr.460000.0.raw.unpack, SQL.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00276504 push esp; retf 2_2_00276505
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0028446D push ecx; ret 2_2_0028446F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0027C3E1 push A00027C4h; ret 2_2_0027C3F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002701F4 push eax; retf 2_2_002701F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0027C2DC pushad ; retn 0027h 2_2_0027C2DD
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0027E3D9 push ds; iretd 2_2_0027E3DD
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001DE217 pushad ; retf 5_2_001DE218
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001DE20D pushad ; retf 5_2_001DE20E
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001D33B4 push eax; retf 5_2_001D33F1
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 5_2_001D33FD pushad ; retf 5_2_001D3401
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_002D33B4 push eax; retf 14_2_002D33F1
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Code function: 14_2_002D33FD pushad ; retf 14_2_002D3401
Source: H8w3nxJQ4Gya5ED[1].scr.2.dr Static PE information: section name: .text entropy: 7.969346935042485
Source: dzmjjohohj75.scr.2.dr Static PE information: section name: .text entropy: 7.969346935042485
Source: JnhNjrgJxHWJu.exe.5.dr Static PE information: section name: .text entropy: 7.969346935042485
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, Qr0GXZ7bMVueK8Ar60.cs High entropy of concatenated method names: 'ToString', 'WoYTcxZufk', 'RW1TF6BANo', 'cjHTebC2Jr', 'du2T90jRnZ', 'P7aTO4hPiA', 'ICrTLjx4fv', 'vyyTo6oAn4', 'SOkTmc5VfX', 'Ik1T0PwHDK'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, u55cF1jCbZEVWBeAM6.cs High entropy of concatenated method names: 'bIMGKYrnYI', 'KP4GClwltx', 'ToString', 'O4sGRqcUbE', 'LQLGajlJtL', 'URTGDAUtSt', 'dgnGEWshfc', 'yuCGWCgUS7', 'WhWGZwFBRe', 'iYlGqp3qNy'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, t50yyWvo1BKsI1Q2gO.cs High entropy of concatenated method names: 'rKg1RVt7ea', 'sb61aC1Pa3', 'm371DxjuD0', 'hWK1ERruJg', 'api1W0TfVS', 'ENx1Z1lTTZ', 'HEy1qt3tsR', 'w7t1sZaPF9', 'h6v1K8WQlN', 'HBD1Cdlb61'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, X7jj3Zqkoe1BhRtf681.cs High entropy of concatenated method names: 'roevhW9txW', 'I0DvrDD0Zu', 'iqcvjNrQNR', 'zkKvIavuy0', 'GoUvN6J4Yg', 'SB2vlydoqw', 'lK2vgsUEsQ', 'PcZvSaSKCp', 'RyHv6IeBY4', 'CJVvBMnnmo'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, f9NbVLcHXK46OOfc1k.cs High entropy of concatenated method names: 'biJDIcLfhg', 'OTKDlS3lRa', 'pitDSTiZGM', 'HSqD6tpxUL', 'mqoD2tx3aY', 'FZ6DTcDvSY', 'TUgDGOEJjt', 'YKeD1ny2c4', 'ACgDvbCNLx', 'WbPD5IP57p'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, coht3l6NZcJOfE8N5g.cs High entropy of concatenated method names: 'ATKjeXU8B', 'qlFIXJBsI', 'SnIl6Ybb5', 'heLgUwQwt', 'b0P6PJA2L', 'kKfB2JYsd', 'D9uWvHxrtgRksAmDtu', 'RvaYEpcadsy3WoeMST', 'aaE10M8pt', 'cbD5u1sge'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, AqGyDHIfPM5Ef66YrD.cs High entropy of concatenated method names: 'Kmnv4v5T8K', 'E0UvUPQ1PA', 'RB6vkuNkXq', 'e3MvRKFebG', 'e1svalggam', 'EZuvEqSrDf', 's1CvW0HKsC', 'wji1ibeGdH', 'XGX1ubkrc1', 'mvx18PNNGW'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, MFfNrDRxSxVvF7CuQ5.cs High entropy of concatenated method names: 'GDd1Pw3qSo', 'Djv1FPV0sB', 'alf1e1qDwF', 'ybu1926Iyc', 'icC1HeY4TB', 'ASP1OY8EPk', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, VRDYqbQsprfc7tIEJf.cs High entropy of concatenated method names: 'L4faHG0aIF', 'yBiaA2lJ3J', 'CvMaplLSFu', 'clsatsZA7v', 'Xh9adgmTkH', 'dFdayPVtsp', 'B8gai7Kr0o', 'AZ3aurQd2P', 'Ahda89Wdx4', 'zC4aVvhjLT'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, Xr1pc2lMdVDvHspak9.cs High entropy of concatenated method names: 'Dispose', 'hZt48nq4gX', 'IxrnF2x95d', 'HOJQQmGK3k', 'gjx4Vs5rpv', 'VAv4z6wjyR', 'ProcessDialogKey', 'YMmnbanM0a', 'R3Pn43qn6Z', 'tUnnnkQset'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, DPCySj1E8CFHgIJk01.cs High entropy of concatenated method names: 'zE1WYlTTRt', 'pjLWhf886G', 'aDUWju3We9', 'o9UWIHgi2J', 'PqaWluNCI8', 'ptpWgZ9pLM', 'dnVW6f5XE1', 'CPyWB9qKUB', 'JdXecsb39ZIDXWQS0AN', 'RNF5CGbiS5fMOZZDWgR'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, amYV1e5gQcEhpZhI0K.cs High entropy of concatenated method names: 'rGIGugdKa4', 'E1QGViwVNv', 'hEm1b4CXbo', 'nFY1466wA8', 'qdEGcLYTa8', 'gF8GJOGy4K', 'wCZG7dSGnO', 'xHiGHiy9VT', 'nHlGAqr2Yu', 'MZ7GpaZdEe'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, GdqMNkaxH17hYA5h9k.cs High entropy of concatenated method names: 'BW34Z4OmO5', 'h8M4qxgZSv', 'D524KM3wfg', 'hvN4CC4KqC', 'zta42cutqI', 'Mmd4TuhPAd', 'RYC3BFAidorqZmDveG', 'QFqAg5GM5jU5YGdFZ7', 'jHw444iQfN', 'LLr4UUpJ31'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, QxPmImpB46JngxCbPV.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'J80n8QpA9U', 'nt1nVLyvDE', 'NYNnzFZbHI', 'o1kUbt7UJk', 'aptU4FQSjC', 'YEeUnMfhNH', 'tRgUUwK2BH', 'f179EZuQnhNvZ5QD1gI'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, uaCgf72SNLFDCL4g0G.cs High entropy of concatenated method names: 'VhyENvO5rq', 'Q1aEgL54J3', 'wO0Devca0F', 'oyXD9Oa7jt', 'nINDOq5qBY', 'NXLDLyL9tO', 'sRgDokNxu4', 'lX1Dmpemx1', 'YXVD04Xc3L', 'CkHDfQMQqB'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, RaLVsOM7BGSUtcNMG0.cs High entropy of concatenated method names: 'XR8WMbDPOa', 'p5nWaX6Dx1', 'pWYWEGFML5', 'NE6WZEXbdV', 'kG5WqBgxLl', 'P2wEdYx6lC', 'epMEyPtUCD', 'JDNEipOyH3', 'QbmEuu9iEk', 'AaLE8rKPJ7'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, BsPLy9qBKYwparJoYRH.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'n4s5Hum0PG', 'S3E5A36k4q', 'Onp5pEnETI', 'fjd5t6c8xV', 'oA75dhvSAc', 'IWT5yQ4Ulu', 'lpN5i3HJCO'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, CdRfhUA8ZqXnBmT4CH.cs High entropy of concatenated method names: 'kBRZhsuZOs', 'Su2ZrRabdv', 'nFbZjJ62F5', 'TMvZI2vypF', 'MwsZN04IaF', 'WBfZlgTrdO', 'nCPZgMf8p3', 'GgRZSpFD2d', 'XotZ6WdcAY', 'cVTZB63AHu'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, CWFMHoxDoIf9ijKOWE.cs High entropy of concatenated method names: 'SQVZRpVj4q', 'yEiZD9P5jX', 'mGAZWhOJWN', 'nn5WVj8x8Z', 'l25WzFDatO', 'djDZbHf919', 'pxVZ4SW3M6', 'DA4Zn86Knw', 'qIEZU3FqYq', 'rnYZkdjLtU'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, XLnLtEz3WhvpXWliEb.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'aWvvxf3Xyr', 'KXSv2cVVYD', 'M9TvTFmSEU', 'Q6SvG5HBdL', 'zvFv1Nvom9', 'I15vvugYV0', 'ks8v5qDua4'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, svduIarRUMutChpRyD.cs High entropy of concatenated method names: 'gGBUMP2ASy', 'LqAURr8FjK', 'MM0Ua70HAe', 'p34UDfHL9m', 'qnuUEfLJ2l', 'ro4UWR72SL', 'P19UZmYvXF', 'xpvUqoiPNj', 'DnRUsKvnKo', 'jI8UKny3Oh'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, sHdSmiSShDB5MBgSX7.cs High entropy of concatenated method names: 'Bab2fYsIAm', 'Smf2JmCOfs', 'qfZ2HlmQyq', 'QkO2AUsGKE', 'Sc32FsZpms', 'Ck62eXHIMX', 'ToT29U6T6q', 'pCj2OP1vL1', 'KaY2LLujPo', 'Lu52o9KClU'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, EXGAJsZ7E8Kdhc5qmq.cs High entropy of concatenated method names: 'wX2xS4khb0', 'IMdx6sZ769', 'n1ZxPpFVkU', 'IltxF5jki3', 'Y3Ex9I6O4L', 'rYsxOFafGY', 'zcmxott7wh', 'qxoxmqNiwI', 'Ldixf87ZRt', 'MmixccVVLY'
Source: 5.2.dzmjjohohj75.scr.3e2f960.5.raw.unpack, RqXGGsqqmSlVZMNK88K.cs High entropy of concatenated method names: 'ToString', 'AgC5UPFOuA', 'GZU5kTF7ct', 'X3O5MhWgQY', 'wvf5RfsuTq', 'nsT5aQJVeC', 'kk35DSRklf', 'lOl5Edw2wh', 'u7I1VBdqliaKmfdAi5y', 'IqPBBcd2aHYlbHPj01X'

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\H8w3nxJQ4Gya5ED[1].scr Jump to dropped file
Installs new ROOT certificates
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\H8w3nxJQ4Gya5ED[1].scr Jump to dropped file
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File created: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JnhNjrgJxHWJu" /XML "C:\Users\user\AppData\Local\Temp\tmp516B.tmp"
Stores large binary data to the registry
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Check if machine is in data center or colocation facility
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: dzmjjohohj75.scr, 00000005.00000002.366840352.0000000003271000.00000004.00000800.00020000.00000000.sdmp, dzmjjohohj75.scr, 0000000C.00000002.616660111.0000000000430000.00000040.00000400.00020000.00000000.sdmp, JnhNjrgJxHWJu.exe, 0000000E.00000002.389323917.0000000003F99000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 1D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 2240000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 3C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 7F20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 8F20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 9110000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: A110000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: A5F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 7F20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 2C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 22D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 950000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: E770000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: C9E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: F770000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 10DB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 14230000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 12830000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 176E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 18A00000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 1DF30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: 1EF30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 150000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 2290000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 2070000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 60C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 5160000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 70C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 80C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 8500000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 9500000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: A500000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 340000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 2490000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 650000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: BC30000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: CC30000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: DA10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: EFE0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 13330000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory allocated: 14330000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 1200000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 1200000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Thread delayed: delay time: 1200000
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2528 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3682 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3579 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Window / User API: threadDelayed 3295 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Window / User API: threadDelayed 6431 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1550
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1928
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2255
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2227
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Window / User API: threadDelayed 9709
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2028 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3092 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 2820 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1504 Thread sleep count: 2528 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1504 Thread sleep count: 3682 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3100 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3116 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 680 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3128 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3140 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2252 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3208 Thread sleep time: -900000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3348 Thread sleep time: -10145709240540247s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3348 Thread sleep time: -2400000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3348 Thread sleep time: -1200000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3348 Thread sleep time: -1200000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3348 Thread sleep time: -40033s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3348 Thread sleep time: -199844s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3348 Thread sleep time: -39633s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3348 Thread sleep time: -60298s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3348 Thread sleep time: -199968s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3348 Thread sleep time: -80209s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3348 Thread sleep time: -58884s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr TID: 3348 Thread sleep time: -41110s >= -30000s Jump to behavior
Source: C:\Windows\System32\taskeng.exe TID: 3292 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe TID: 3632 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe TID: 3312 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3532 Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3544 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3532 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3424 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3604 Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3624 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3564 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe TID: 3744 Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe TID: 3780 Thread sleep time: -18446744073709540s >= -30000s
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe TID: 3780 Thread sleep time: -2400000s >= -30000s
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe TID: 3804 Thread sleep count: 9709 > 30
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe TID: 3780 Thread sleep time: -1200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe TID: 3792 Thread sleep count: 65 > 30
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe TID: 3780 Thread sleep time: -800000s >= -30000s
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe TID: 3780 Thread sleep time: -79751s >= -30000s
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe TID: 3780 Thread sleep time: -99719s >= -30000s
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe TID: 3780 Thread sleep time: -80147s >= -30000s
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3860 Thread sleep time: -240000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 1200000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 1200000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 40033 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 99922 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 39633 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 60298 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 99984 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 80209 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 58884 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Thread delayed: delay time: 41110 Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Thread delayed: delay time: 79751
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Thread delayed: delay time: 99719
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Thread delayed: delay time: 80147
Source: JnhNjrgJxHWJu.exe, 0000000E.00000002.389323917.0000000003F99000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: JnhNjrgJxHWJu.exe, 0000000E.00000002.389323917.0000000003F99000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Code function: 12_2_002C5348 CheckRemoteDebuggerPresent, 12_2_002C5348
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process queried: DebugPort
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzmjjohohj75.scr"
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzmjjohohj75.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Memory written: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Memory written: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe base: 400000 value starts with: 4D5A
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr "C:\Users\user\AppData\Roaming\dzmjjohohj75.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzmjjohohj75.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JnhNjrgJxHWJu" /XML "C:\Users\user\AppData\Local\Temp\tmp516B.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Process created: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr "C:\Users\user\AppData\Roaming\dzmjjohohj75.scr" Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process created: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JnhNjrgJxHWJu" /XML "C:\Users\user\AppData\Local\Temp\tmp69FA.tmp"
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Process created: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe "C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe"
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Queries volume information: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Queries volume information: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Queries volume information: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Queries volume information: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe VolumeInformation
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3f999c0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.32ad150.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.3271930.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dzmjjohohj75.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3fd51e0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.32ad150.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3fd51e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3f999c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.616660111.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.389323917.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.617849885.0000000002300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.617842734.00000000024C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.366840352.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dzmjjohohj75.scr PID: 1376, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dzmjjohohj75.scr PID: 3132, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: JnhNjrgJxHWJu.exe PID: 3300, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: JnhNjrgJxHWJu.exe PID: 3700, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzmjjohohj75.scr Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Roaming\JnhNjrgJxHWJu.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Yara detected Credential Stealer
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3f999c0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.32ad150.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.3271930.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dzmjjohohj75.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3fd51e0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.32ad150.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3fd51e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3f999c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.616660111.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.389323917.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.617849885.0000000002300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.617842734.00000000024C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.366840352.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dzmjjohohj75.scr PID: 1376, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dzmjjohohj75.scr PID: 3132, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: JnhNjrgJxHWJu.exe PID: 3300, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: JnhNjrgJxHWJu.exe PID: 3700, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3f999c0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.32ad150.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.3271930.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dzmjjohohj75.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3fd51e0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.32ad150.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3fd51e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.JnhNjrgJxHWJu.exe.3f999c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzmjjohohj75.scr.3271930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.616660111.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.389323917.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.617849885.0000000002300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.617842734.00000000024C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.366840352.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dzmjjohohj75.scr PID: 1376, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dzmjjohohj75.scr PID: 3132, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: JnhNjrgJxHWJu.exe PID: 3300, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: JnhNjrgJxHWJu.exe PID: 3700, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1427892 Sample: Remittance 18042024.doc Startdate: 18/04/2024 Architecture: WINDOWS Score: 100 53 us2.smtp.mailhostbox.com 2->53 55 smtp.fshpxm.com 2->55 71 Malicious sample detected (through community Yara rule) 2->71 73 Sigma detected: Scheduled temp file as task from temp location 2->73 75 Multi AV Scanner detection for submitted file 2->75 77 15 other signatures 2->77 9 WINWORD.EXE 336 14 2->9         started        11 taskeng.exe 2->11         started        signatures3 process4 process5 13 EQNEDT32.EXE 11 9->13         started        18 EQNEDT32.EXE 9->18         started        20 JnhNjrgJxHWJu.exe 11->20         started        dnsIp6 69 dukeenergyltd.top 172.67.134.136, 443, 49163 CLOUDFLARENETUS United States 13->69 49 C:\Users\user\AppData\...\dzmjjohohj75.scr, PE32 13->49 dropped 51 C:\Users\user\...\H8w3nxJQ4Gya5ED[1].scr, PE32 13->51 dropped 103 Installs new ROOT certificates 13->103 105 Office equation editor establishes network connection 13->105 107 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 13->107 22 dzmjjohohj75.scr 1 10 13->22         started        109 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 20->109 111 Machine Learning detection for dropped file 20->111 113 Adds a directory exclusion to Windows Defender 20->113 115 Injects a PE file into a foreign processes 20->115 26 JnhNjrgJxHWJu.exe 20->26         started        29 powershell.exe 20->29         started        31 powershell.exe 20->31         started        33 schtasks.exe 20->33         started        file7 signatures8 process9 dnsIp10 45 C:\Users\user\AppData\...\JnhNjrgJxHWJu.exe, PE32 22->45 dropped 47 C:\Users\user\AppData\Local\...\tmp516B.tmp, XML 22->47 dropped 87 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 22->87 89 Machine Learning detection for dropped file 22->89 91 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 22->91 101 4 other signatures 22->101 35 dzmjjohohj75.scr 12 2 22->35         started        39 powershell.exe 4 22->39         started        41 powershell.exe 4 22->41         started        43 schtasks.exe 22->43         started        63 192.168.2.255, 137, 138 unknown unknown 26->63 65 us2.smtp.mailhostbox.com 26->65 67 2 other IPs or domains 26->67 93 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 26->93 95 Tries to steal Mail credentials (via file / registry access) 26->95 97 Tries to harvest and steal browser information (history, passwords, etc) 26->97 99 Installs a global keyboard hook 26->99 file11 signatures12 process13 dnsIp14 57 ip-api.com 208.95.112.1, 49164, 49168, 80 TUT-ASUS United States 35->57 59 208.91.198.143, 49165, 49169, 49170 PUBLIC-DOMAIN-REGISTRYUS United States 35->59 61 2 other IPs or domains 35->61 79 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 35->79 81 Tries to steal Mail credentials (via file / registry access) 35->81 83 Installs a global keyboard hook 35->83 85 Installs new ROOT certificates 39->85 signatures15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.91.198.143
 unknown United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS false
208.91.199.225
 us2.smtp.mailhostbox.com United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
172.67.134.136
 dukeenergyltd.top United States
13335 CLOUDFLARENETUS true

Private

IP
192.168.2.255

Contacted Domains

Name IP Active
dukeenergyltd.top 172.67.134.136 true
us2.smtp.mailhostbox.com 208.91.199.225 true
ip-api.com 208.95.112.1 true
smtp.fshpxm.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://dukeenergyltd.top/H8w3nxJQ4Gya5ED.scr true
    		unknown
    http://ip-api.com/line/?fields=hosting false
      		high