Windows Analysis Report
Remittance 17042024.doc

Overview

General Information

Sample name: Remittance 17042024.doc
Analysis ID: 1427896
MD5: 3a70ce88c392ad13548a5337379ec365
SHA1: 759142b5f93e6b7821c9eb30639448fc2fd13cd4
SHA256: 45d5436e268ed053f251044846ac8f0c5c09015cc87c4ccbdc86c4efbad9e570
Tags: doc
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Document exploit detected (process start blacklist hit)
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Installs a global keyboard hook
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Microsoft Office Child Process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Powershell Defender Exclusion
Sigma detected: SCR File Write Event
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Suspicious Screensaver Binary File Creation
Stores large binary data to the registry
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Found malware configuration
Source: 13.2.dzoihohj75439.scr.400000.0.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.fshpxm.com", "Username": "origin@fshpxm.com", "Password": "gG(YGS^4"}
Multi AV Scanner detection for domain / URL
Source: covid19help.top Virustotal: Detection: 24% Perma Link
Source: https://covid19help.top/JBNvj66BwYU3yCv.scr Virustotal: Detection: 22% Perma Link
Source: https://covid19help.top/ Virustotal: Detection: 23% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr Virustotal: Detection: 63% Perma Link
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Virustotal: Detection: 63% Perma Link
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Virustotal: Detection: 63% Perma Link
Multi AV Scanner detection for submitted file
Source: Remittance 17042024.doc ReversingLabs: Detection: 44%
Source: Remittance 17042024.doc Virustotal: Detection: 45% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Joe Sandbox ML: detected

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 104.21.83.128 Port: 443 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 104.21.83.128:443 -> 192.168.2.22:49161 version: TLS 1.2

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: covid19help.top
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Source: global traffic DNS query: name: smtp.fshpxm.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.95.112.1:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 208.91.198.143:587
Source: global traffic TCP traffic: 208.91.198.143:587 -> 192.168.2.22:49170

Networking
barindex
Yara detected Generic Downloader
Source: Yara match File source: 13.2.dzoihohj75439.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzoihohj75439.scr.3419a00.6.raw.unpack, type: UNPACKEDPE
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 208.91.199.225:587
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 208.91.199.224:587
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 208.91.199.223:587
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View IP Address: 208.91.199.225 208.91.199.225
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe DNS query: name: ip-api.com
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 208.91.198.143:587
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 208.91.199.225:587
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 208.91.199.224:587
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 208.91.199.223:587
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /JBNvj66BwYU3yCv.scr HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: covid19help.topConnection: Keep-Alive
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FE2D0FDB-7F0A-4F00-BC04-18F54428C4C8}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /JBNvj66BwYU3yCv.scr HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: covid19help.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: unknown DNS traffic detected: queries for: covid19help.top
Source: EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F2E000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr, 00000005.00000002.365439049.0000000006EFA000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr.2.dr, JBNvj66BwYU3yCv[1].scr.2.dr, egFUHsL.exe.5.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F20000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F2E000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr, 00000005.00000002.365439049.0000000006EFA000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr.2.dr, JBNvj66BwYU3yCv[1].scr.2.dr, egFUHsL.exe.5.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: dzoihohj75439.scr, 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, dzoihohj75439.scr, 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, dzoihohj75439.scr, 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, egFUHsL.exe, 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F20000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F2E000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr, 00000005.00000002.365439049.0000000006EFA000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr.2.dr, JBNvj66BwYU3yCv[1].scr.2.dr, egFUHsL.exe.5.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: dzoihohj75439.scr, 00000005.00000002.361137396.0000000002238000.00000004.00000800.00020000.00000000.sdmp, dzoihohj75439.scr, 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, egFUHsL.exe, 0000000F.00000002.372430657.0000000002351000.00000004.00000800.00020000.00000000.sdmp, egFUHsL.exe, 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: dzoihohj75439.scr, 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, dzoihohj75439.scr, 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/JBNvj66BwYU3yCv.scr
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/JBNvj66BwYU3yCv.scrC:
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/JBNvj66BwYU3yCv.scrj
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/JBNvj66BwYU3yCv.scrttC:
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/tV
Source: EQNEDT32.EXE, 00000002.00000002.346682553.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: EQNEDT32.EXE, 00000002.00000002.346682553.000000000064F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353617017.0000000003F2E000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr, 00000005.00000002.365439049.0000000006EFA000.00000004.00000020.00020000.00000000.sdmp, dzoihohj75439.scr.2.dr, JBNvj66BwYU3yCv[1].scr.2.dr, egFUHsL.exe.5.dr String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: unknown Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown HTTPS traffic detected: 104.21.83.128:443 -> 192.168.2.22:49161 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Installs a global keyboard hook
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\dzoihohj75439.scr Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\egFUHsL.exe
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Window created: window name: CLIPBRDWNDCLASS

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Remittance 17042024.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 5.2.dzoihohj75439.scr.3419a00.6.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.dzoihohj75439.scr.33de1e0.7.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 13.2.dzoihohj75439.scr.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.dzoihohj75439.scr.3419a00.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable editing") from the yellow bar aboveASSIGNMENTMCS 473: MARKETING MANAGEMENT & STRATEGYSTUDENT
.NET source code contains very large array initializations
Source: 5.2.dzoihohj75439.scr.600000.0.raw.unpack, .cs Large array initialization: : array initializer size 13798
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 5_2_001F7040 5_2_001F7040
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 5_2_001FD0B8 5_2_001FD0B8
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 5_2_001F133D 5_2_001F133D
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 5_2_001FBC78 5_2_001FBC78
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 5_2_001F8DB0 5_2_001F8DB0
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 5_2_009F4888 5_2_009F4888
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 5_2_009F4CC0 5_2_009F4CC0
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 5_2_009F50F8 5_2_009F50F8
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 5_2_009F50F1 5_2_009F50F1
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 5_2_009F4450 5_2_009F4450
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 5_2_009F55E0 5_2_009F55E0
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 13_2_001C8878 13_2_001C8878
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 13_2_001C4070 13_2_001C4070
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 13_2_001C3928 13_2_001C3928
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 13_2_001C4940 13_2_001C4940
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 13_2_001CF3B0 13_2_001CF3B0
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 13_2_001CBBC8 13_2_001CBBC8
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 13_2_004F6550 13_2_004F6550
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 13_2_004F51F1 13_2_004F51F1
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 13_2_004F0580 13_2_004F0580
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 13_2_004F1640 13_2_004F1640
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 13_2_004F8778 13_2_004F8778
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_002FD0B8 15_2_002FD0B8
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_002FE0D0 15_2_002FE0D0
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_002FBC78 15_2_002FBC78
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_002F8DB0 15_2_002F8DB0
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_00AA4888 15_2_00AA4888
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_00AA50F8 15_2_00AA50F8
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_00AA50F1 15_2_00AA50F1
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_00AA4CC0 15_2_00AA4CC0
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_00AA4450 15_2_00AA4450
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_00AA55E0 15_2_00AA55E0
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 22_2_001C8878 22_2_001C8878
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 22_2_001C4070 22_2_001C4070
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 22_2_001C3928 22_2_001C3928
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 22_2_001C4940 22_2_001C4940
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 22_2_001CF3B0 22_2_001CF3B0
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 22_2_001CBBC8 22_2_001CBBC8
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 22_2_006D6550 22_2_006D6550
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 22_2_006D51F1 22_2_006D51F1
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 22_2_006D0580 22_2_006D0580
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 22_2_006D1640 22_2_006D1640
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 22_2_006D8778 22_2_006D8778
Document contains embedded VBA macros
Source: tmp871B.tmp.5.dr OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: tmp871B.tmp.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Yara signature match
Source: Remittance 17042024.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 5.2.dzoihohj75439.scr.3419a00.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.dzoihohj75439.scr.33de1e0.7.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 13.2.dzoihohj75439.scr.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.dzoihohj75439.scr.3419a00.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: JBNvj66BwYU3yCv[1].scr.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: dzoihohj75439.scr.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: egFUHsL.exe.5.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, EjX9gQSXWavgOAKiaJ.cs Security API names: _0020.SetAccessControl
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, EjX9gQSXWavgOAKiaJ.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, EjX9gQSXWavgOAKiaJ.cs Security API names: _0020.AddAccessRule
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, b8tmsF9xU9Z1v5o74w.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, b8tmsF9xU9Z1v5o74w.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, EjX9gQSXWavgOAKiaJ.cs Security API names: _0020.SetAccessControl
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, EjX9gQSXWavgOAKiaJ.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, EjX9gQSXWavgOAKiaJ.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winDOC@26/22@241/7
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$mittance 17042024.doc Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Mutant created: \Sessions\1\BaseNamedObjects\CXJbfdRjUuNVJpbtO
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR6279.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n.......................d..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d......."..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.d.......4..........................s.................... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d.......A..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d.......S..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d......._..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....u..........................s....................$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................d..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n...............................!..........................s............x...............8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................-..........................s............x...............8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.........E..........................s............x....... .......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Q..........................s............x...............8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................g..........................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................s..........................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s............x.......$.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............x...............8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............x.......2.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............x...............8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s....................l.......8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............x............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P........................................................s............x...............8............... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............x...............8............... Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Console Write: ........................................(.P.....$.......@....................................................................................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................5.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................&5.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................55.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................e5.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................5.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n................................5.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................5.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........5.........................s.................... .......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............................. 6.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................96.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................I6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....c6.........................s....................$.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................t6.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................6.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................6.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................6.........................s....................l.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................6.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................7.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................7.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................+.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................++.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................@+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................L+.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................^+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................k+.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................a.g.a.i.n...............................}+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........+.........................s.................... .......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................+.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......+.........................s....................$.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................+.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................,.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................$,.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................H,.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................],.........................s....................l.......x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................i,.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............................{,.........................s............................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................,.........................s............................x...............
Source: C:\Windows\SysWOW64\schtasks.exe Console Write: ................................E.R.R.O.R.:. ............................(......................................x.$.............................
Source: C:\Windows\SysWOW64\schtasks.exe Console Write: ................................E.R.R.O.(.P..............................(..............................................j.......x...............
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: Remittance 17042024.doc ReversingLabs: Detection: 44%
Source: Remittance 17042024.doc Virustotal: Detection: 45%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Source: unknown Process created: C:\Windows\System32\taskeng.exe taskeng.exe {E15E873E-836C-4FC1-A12D-690BEBE78D2E} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe Process created: C:\Users\user\AppData\Roaming\egFUHsL.exe C:\Users\user\AppData\Roaming\egFUHsL.exe
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp9A3D.tmp"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Users\user\AppData\Roaming\egFUHsL.exe "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process created: C:\Users\user\AppData\Roaming\egFUHsL.exe C:\Users\user\AppData\Roaming\egFUHsL.exe
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp9A3D.tmp"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Users\user\AppData\Roaming\egFUHsL.exe "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: credssp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ncrypt.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: bcrypt.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\taskeng.exe Section loaded: wevtapi.dll
Source: C:\Windows\System32\taskeng.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\taskeng.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\taskeng.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\taskeng.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: wbemcomn2.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Section loaded: windowscodecs.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: Remittance 17042024.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\Remittance 17042024.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, EjX9gQSXWavgOAKiaJ.cs .Net Code: HokWmiwN44 System.Reflection.Assembly.Load(byte[])
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, EjX9gQSXWavgOAKiaJ.cs .Net Code: HokWmiwN44 System.Reflection.Assembly.Load(byte[])
Source: 5.2.dzoihohj75439.scr.600000.0.raw.unpack, LoginForm.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_006501F4 push eax; retf 2_2_006501F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0065C2DC pushad ; retn 0065h 2_2_0065C2DD
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 5_2_009F7330 pushfd ; iretd 5_2_009F7339
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_002F150A push FFFFFF83h; iretd 15_2_002F1524
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_002F793B push es; iretd 15_2_002F7955
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Code function: 15_2_002F3AB8 push esp; retn 0026h 15_2_002F3AB9
Source: JBNvj66BwYU3yCv[1].scr.2.dr Static PE information: section name: .text entropy: 7.926722076742294
Source: dzoihohj75439.scr.2.dr Static PE information: section name: .text entropy: 7.926722076742294
Source: egFUHsL.exe.5.dr Static PE information: section name: .text entropy: 7.926722076742294
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, b8tmsF9xU9Z1v5o74w.cs High entropy of concatenated method names: 't51gTlpbvA', 'wNDgQvlokI', 'mQBgslQ3EX', 'y00g7mEw2Q', 'uoegYYO9jv', 'x2pgfoOulS', 'B60g09Do4c', 'XxHgNwDfBQ', 'ADZgwTD5cQ', 'E4egheDTar'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, R2aTrjUZSGhApXVB6N.cs High entropy of concatenated method names: 'HCVyNxV15o', 'gUlyhC3DoQ', 'Qv4KjhJxf9', 'jK8KboWTjG', 's2ZyBx7ae1', 'pWDy4Judbr', 'Oylya4hfpq', 'FpYyTOFEPq', 'e0hyQX1g0n', 'itLysxS17u'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, SE8ei8323SpOWjlTO6.cs High entropy of concatenated method names: 'griJb8qMTq', 'HP2J1Ml9yA', 'J9LJWiIP6u', 'H35JuQQG79', 'UglJgHpjsE', 'J8bJ9MeiSO', 'vU4JxLEh6A', 'xXHK0yQos8', 'AwYKNnDI8W', 'KPJKwQnDGd'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, Xyspjtd27UNPsTmZCs.cs High entropy of concatenated method names: 'govbPmxQfM', 'unGbVhsaaF', 'nYgblQem76', 'p7UbZYq56j', 'tJFbpq2T5B', 'blAbqv6tbv', 'cYPlwWdWbX3J1g9SDV', 'EsEklB3a012Q0WeaHe', 'S7QbbMDLhd', 'MAob1A12rp'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, c9sjD5bjIqyP5D3sx6.cs High entropy of concatenated method names: 'GpCH5Mr5Lv', 'wiCHOHh4xc', 'W7eHcESXtE', 'agGH8hL6j5', 'BHFHprC8Ki', 'SW2HqHyMEo', 'JIFHyqnTK7', 'Ke0HKnYm1f', 'qeYHJItfW4', 'k3QH6pI1kv'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, W0JwQqCGXX23lSQM8d.cs High entropy of concatenated method names: 'eIY9CpqaPR', 'dUD9d2N4CB', 'S0WHXUwhTL', 'RReH3HKH5v', 'SCqHkJeJsY', 'jSIHGDKoNQ', 'w3RHelIWeM', 'c9gHioBhdY', 'QPTHMqv3MA', 'vXaHEYgebU'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, RpNwKIh1quupYTAWJq.cs High entropy of concatenated method names: 'nZPKoHaA9y', 'Ex2KrG7fIx', 'O7BKX6EngB', 'EaiK3FQi3J', 'fITKTEhHdC', 't4CKk2yw8i', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, o3AqPRMLTG9jt0XNEUA.cs High entropy of concatenated method names: 'QLvJSpAVxO', 'h4iJ27jIlQ', 'vcPJm6QaBc', 'HKbJ58j9aW', 'WGlJCGol8v', 'fB9JOPPc8L', 'yJuJdBRQbw', 'Ax8JcScZhq', 'e9gJ8GcL1c', 'HrYJAXhSq6'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, Q8VsNLPepUDd5G6cwB.cs High entropy of concatenated method names: 'TCRPuUS3Uk', 'B9sPHi9Z5P', 'z8OPxyKheo', 'krMxhE1pRs', 'Xraxzidn5A', 'FpiPjUPTxI', 'kk6Pbk4I63', 'UuhPvaWKDX', 'RIBP1gnQFJ', 'yprPWRb1C4'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, SD50yhgTTo4BDKVIvI.cs High entropy of concatenated method names: 'co1tc9Wiwu', 'WpEt8v2AMt', 'tn6to7e6Le', 'Y27trC2vxw', 'j3Ft3113FK', 'mQxtkANDQw', 'rmFtexXXZa', 'n8jtiqK2Z5', 'nEhtEbX0nm', 'Qd0tBwui1T'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, Sb59cPIvBCJELE9Lt1.cs High entropy of concatenated method names: 'nxfxFcS8WI', 'zbHxguTHpW', 'HEox9O6l54', 'XcixPxRuHM', 'As3xVtqqgK', 'zvJ9YSvLbl', 'eY99fap2pd', 'bW190Anmod', 'HBN9NdMOoo', 'EW49wpREis'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, jBgHpTxfiBFwai9cLd.cs High entropy of concatenated method names: 'TqSpECwCe4', 'nDjp4sp18w', 'JjdpTEZH4V', 'cBppQYMUYc', 'bAXprpv8SQ', 'lhppXL8NtU', 'JSmp3elkYd', 'umVpk4uBxo', 'Jr9pGCkx42', 'B5jpepd2Ki'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, IphJi82PHmFmnIX9f9.cs High entropy of concatenated method names: 'O4ryle8PmR', 'Ks4yZIdRJc', 'ToString', 'GPyyu9MAIb', 'aj1ygfdhuK', 'i0hyHMDTdF', 'Qpky9CxTO7', 'DBZyxNH7ue', 'wo0yPEMlux', 'zhpyVPIFv8'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, vtC8w5RPTmxUvrRvBU.cs High entropy of concatenated method names: 'ToString', 'orOqBRHpUm', 'xxKqravW1t', 'zR9qXO73NZ', 'BcAq3vHdNp', 'A7EqkxsW0e', 'cj7qGYUJhF', 'EUSqeSuFoL', 'z5VqiNPWri', 'npLqMsGc6h'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, dbQQPlY74ymdeL3mPO.cs High entropy of concatenated method names: 'zU0m3eZ48', 'cts5Ldi6a', 'tv2OfCwa4', 'OyrdZHiLY', 'eMl8IxwIX', 'om8AgTU0h', 'cpOYPTGU6hhBd4bSmi', 'qtKqE47XkHjBOEswC9', 'zdsKhYCaC', 'Gtb6XfsDa'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, whQdg8zbGa9CLqYN2J.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PADJtj6op4', 'qw7JpNwFyx', 'rKuJqQg3oT', 'cgYJyua4N4', 'jRyJKbeGj2', 'L1QJJlfsms', 'SS2J6lfjcZ'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, EjX9gQSXWavgOAKiaJ.cs High entropy of concatenated method names: 'wOD1Fd6540', 'fEC1unxdYA', 'V7B1gtUmVq', 'xFQ1HG0Akt', 'PCM19aoONm', 'eWx1xt0gIp', 'eFh1PIo5TV', 'IPe1VXceXX', 'OuM1DYNQTs', 'Ku31lJbuR8'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, IpnFxe0jUJqbrvbLc7.cs High entropy of concatenated method names: 'VpdjiaRjhN4cfhdsMvE', 'xaxy06R04c2gD9C1Zou', 'z1txK6ihTl', 'okrxJrZuqB', 'eXPx6W4CD0', 'ztdWP5ROOafWGoqQsoq', 'KTslAgRk273y3sGpv0D'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, vecnntKZmWmrT6UEmG.cs High entropy of concatenated method names: 'Dispose', 'WYbbwYL4Iy', 'YCDvrUlXxs', 'l7KUUHHmSg', 'VmDbhwGtgm', 'usEbzSeCdF', 'ProcessDialogKey', 'EBbvjuwTrh', 'lyOvbSvdRX', 'T06vvd8Z93'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, FukiUSA0vcIEgBScU2.cs High entropy of concatenated method names: 'zOKPSVo6V5', 'UoQP2RiNlx', 'TQCPm08G2H', 's4KP5PKASV', 'BnRPCuSVna', 'mpyPOrVwvS', 'GfJPdL7r9B', 'fJsPcGIWVi', 'U0TP8vQ9Td', 'RAkPApVJgL'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, KnkMnHMuuAR5gypCln4.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PDM6TUIlyd', 'HDU6Q7YSvM', 'nZ16sxMaIh', 'jq567btrEh', 'v2c6YLmsH9', 'D8D6fIwphK', 'UVI60wXPxh'
Source: 5.2.dzoihohj75439.scr.50b0000.9.raw.unpack, ohPx6xFEdxkA3fYdLs.cs High entropy of concatenated method names: 'YvRKu1J0uV', 'QKLKg1803I', 'hk0KH84WOP', 'G4hK9corYV', 'EH8KxyLPRY', 'SrjKPUJw9E', 'J2gKVM4SlN', 'lLAKDhalkm', 'be2KlMDXtp', 'lwEKZ8uG6Q'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, b8tmsF9xU9Z1v5o74w.cs High entropy of concatenated method names: 't51gTlpbvA', 'wNDgQvlokI', 'mQBgslQ3EX', 'y00g7mEw2Q', 'uoegYYO9jv', 'x2pgfoOulS', 'B60g09Do4c', 'XxHgNwDfBQ', 'ADZgwTD5cQ', 'E4egheDTar'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, R2aTrjUZSGhApXVB6N.cs High entropy of concatenated method names: 'HCVyNxV15o', 'gUlyhC3DoQ', 'Qv4KjhJxf9', 'jK8KboWTjG', 's2ZyBx7ae1', 'pWDy4Judbr', 'Oylya4hfpq', 'FpYyTOFEPq', 'e0hyQX1g0n', 'itLysxS17u'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, SE8ei8323SpOWjlTO6.cs High entropy of concatenated method names: 'griJb8qMTq', 'HP2J1Ml9yA', 'J9LJWiIP6u', 'H35JuQQG79', 'UglJgHpjsE', 'J8bJ9MeiSO', 'vU4JxLEh6A', 'xXHK0yQos8', 'AwYKNnDI8W', 'KPJKwQnDGd'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, Xyspjtd27UNPsTmZCs.cs High entropy of concatenated method names: 'govbPmxQfM', 'unGbVhsaaF', 'nYgblQem76', 'p7UbZYq56j', 'tJFbpq2T5B', 'blAbqv6tbv', 'cYPlwWdWbX3J1g9SDV', 'EsEklB3a012Q0WeaHe', 'S7QbbMDLhd', 'MAob1A12rp'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, c9sjD5bjIqyP5D3sx6.cs High entropy of concatenated method names: 'GpCH5Mr5Lv', 'wiCHOHh4xc', 'W7eHcESXtE', 'agGH8hL6j5', 'BHFHprC8Ki', 'SW2HqHyMEo', 'JIFHyqnTK7', 'Ke0HKnYm1f', 'qeYHJItfW4', 'k3QH6pI1kv'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, W0JwQqCGXX23lSQM8d.cs High entropy of concatenated method names: 'eIY9CpqaPR', 'dUD9d2N4CB', 'S0WHXUwhTL', 'RReH3HKH5v', 'SCqHkJeJsY', 'jSIHGDKoNQ', 'w3RHelIWeM', 'c9gHioBhdY', 'QPTHMqv3MA', 'vXaHEYgebU'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, RpNwKIh1quupYTAWJq.cs High entropy of concatenated method names: 'nZPKoHaA9y', 'Ex2KrG7fIx', 'O7BKX6EngB', 'EaiK3FQi3J', 'fITKTEhHdC', 't4CKk2yw8i', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, o3AqPRMLTG9jt0XNEUA.cs High entropy of concatenated method names: 'QLvJSpAVxO', 'h4iJ27jIlQ', 'vcPJm6QaBc', 'HKbJ58j9aW', 'WGlJCGol8v', 'fB9JOPPc8L', 'yJuJdBRQbw', 'Ax8JcScZhq', 'e9gJ8GcL1c', 'HrYJAXhSq6'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, Q8VsNLPepUDd5G6cwB.cs High entropy of concatenated method names: 'TCRPuUS3Uk', 'B9sPHi9Z5P', 'z8OPxyKheo', 'krMxhE1pRs', 'Xraxzidn5A', 'FpiPjUPTxI', 'kk6Pbk4I63', 'UuhPvaWKDX', 'RIBP1gnQFJ', 'yprPWRb1C4'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, SD50yhgTTo4BDKVIvI.cs High entropy of concatenated method names: 'co1tc9Wiwu', 'WpEt8v2AMt', 'tn6to7e6Le', 'Y27trC2vxw', 'j3Ft3113FK', 'mQxtkANDQw', 'rmFtexXXZa', 'n8jtiqK2Z5', 'nEhtEbX0nm', 'Qd0tBwui1T'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, Sb59cPIvBCJELE9Lt1.cs High entropy of concatenated method names: 'nxfxFcS8WI', 'zbHxguTHpW', 'HEox9O6l54', 'XcixPxRuHM', 'As3xVtqqgK', 'zvJ9YSvLbl', 'eY99fap2pd', 'bW190Anmod', 'HBN9NdMOoo', 'EW49wpREis'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, jBgHpTxfiBFwai9cLd.cs High entropy of concatenated method names: 'TqSpECwCe4', 'nDjp4sp18w', 'JjdpTEZH4V', 'cBppQYMUYc', 'bAXprpv8SQ', 'lhppXL8NtU', 'JSmp3elkYd', 'umVpk4uBxo', 'Jr9pGCkx42', 'B5jpepd2Ki'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, IphJi82PHmFmnIX9f9.cs High entropy of concatenated method names: 'O4ryle8PmR', 'Ks4yZIdRJc', 'ToString', 'GPyyu9MAIb', 'aj1ygfdhuK', 'i0hyHMDTdF', 'Qpky9CxTO7', 'DBZyxNH7ue', 'wo0yPEMlux', 'zhpyVPIFv8'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, vtC8w5RPTmxUvrRvBU.cs High entropy of concatenated method names: 'ToString', 'orOqBRHpUm', 'xxKqravW1t', 'zR9qXO73NZ', 'BcAq3vHdNp', 'A7EqkxsW0e', 'cj7qGYUJhF', 'EUSqeSuFoL', 'z5VqiNPWri', 'npLqMsGc6h'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, dbQQPlY74ymdeL3mPO.cs High entropy of concatenated method names: 'zU0m3eZ48', 'cts5Ldi6a', 'tv2OfCwa4', 'OyrdZHiLY', 'eMl8IxwIX', 'om8AgTU0h', 'cpOYPTGU6hhBd4bSmi', 'qtKqE47XkHjBOEswC9', 'zdsKhYCaC', 'Gtb6XfsDa'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, whQdg8zbGa9CLqYN2J.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PADJtj6op4', 'qw7JpNwFyx', 'rKuJqQg3oT', 'cgYJyua4N4', 'jRyJKbeGj2', 'L1QJJlfsms', 'SS2J6lfjcZ'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, EjX9gQSXWavgOAKiaJ.cs High entropy of concatenated method names: 'wOD1Fd6540', 'fEC1unxdYA', 'V7B1gtUmVq', 'xFQ1HG0Akt', 'PCM19aoONm', 'eWx1xt0gIp', 'eFh1PIo5TV', 'IPe1VXceXX', 'OuM1DYNQTs', 'Ku31lJbuR8'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, IpnFxe0jUJqbrvbLc7.cs High entropy of concatenated method names: 'VpdjiaRjhN4cfhdsMvE', 'xaxy06R04c2gD9C1Zou', 'z1txK6ihTl', 'okrxJrZuqB', 'eXPx6W4CD0', 'ztdWP5ROOafWGoqQsoq', 'KTslAgRk273y3sGpv0D'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, vecnntKZmWmrT6UEmG.cs High entropy of concatenated method names: 'Dispose', 'WYbbwYL4Iy', 'YCDvrUlXxs', 'l7KUUHHmSg', 'VmDbhwGtgm', 'usEbzSeCdF', 'ProcessDialogKey', 'EBbvjuwTrh', 'lyOvbSvdRX', 'T06vvd8Z93'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, FukiUSA0vcIEgBScU2.cs High entropy of concatenated method names: 'zOKPSVo6V5', 'UoQP2RiNlx', 'TQCPm08G2H', 's4KP5PKASV', 'BnRPCuSVna', 'mpyPOrVwvS', 'GfJPdL7r9B', 'fJsPcGIWVi', 'U0TP8vQ9Td', 'RAkPApVJgL'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, KnkMnHMuuAR5gypCln4.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PDM6TUIlyd', 'HDU6Q7YSvM', 'nZ16sxMaIh', 'jq567btrEh', 'v2c6YLmsH9', 'D8D6fIwphK', 'UVI60wXPxh'
Source: 5.2.dzoihohj75439.scr.354b6b0.5.raw.unpack, ohPx6xFEdxkA3fYdLs.cs High entropy of concatenated method names: 'YvRKu1J0uV', 'QKLKg1803I', 'hk0KH84WOP', 'G4hK9corYV', 'EH8KxyLPRY', 'SrjKPUJw9E', 'J2gKVM4SlN', 'lLAKDhalkm', 'be2KlMDXtp', 'lwEKZ8uG6Q'

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Jump to dropped file
Installs new ROOT certificates
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\JBNvj66BwYU3yCv[1].scr Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Jump to dropped file
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File created: C:\Users\user\AppData\Roaming\egFUHsL.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp"
Stores large binary data to the registry
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Check if machine is in data center or colocation facility
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: dzoihohj75439.scr, 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, dzoihohj75439.scr, 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 1F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 21E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 560000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 53D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 63D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 5250000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 1B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 2590000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 350000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: C920000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 9180000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 11220000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 12220000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: D920000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 12880000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 16550000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 21BC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 2A8C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 26FD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 2E5C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 2F5C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 2D340000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 33C10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 34C10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: 36610000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 2F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 2350000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 8C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 5330000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 6330000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 6700000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 7700000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 1C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 2350000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 5A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: E800000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: D770000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: B320000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 11C10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 13A10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 14190000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 17CB0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 18CB0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 1F690000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 20690000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 1D900000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 21A90000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory allocated: 232E0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 1200000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 1200000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 1200000
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 767 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6695 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4228 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2084 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Window / User API: threadDelayed 3242 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Window / User API: threadDelayed 6562 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3180
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3055
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2170
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1467
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Window / User API: threadDelayed 1507
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Window / User API: threadDelayed 8309
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3328 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 3668 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 3476 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3584 Thread sleep count: 767 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3584 Thread sleep count: 6695 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3736 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3744 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3616 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3760 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3764 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3760 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3664 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 3864 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060 Thread sleep time: -15679732462653109s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060 Thread sleep time: -3600000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060 Thread sleep time: -1200000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060 Thread sleep time: -1000000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060 Thread sleep time: -59383s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060 Thread sleep time: -40611s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060 Thread sleep time: -38635s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr TID: 4060 Thread sleep time: -61358s >= -30000s Jump to behavior
Source: C:\Windows\System32\taskeng.exe TID: 3876 Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 2392 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3904 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056 Thread sleep count: 3180 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056 Thread sleep count: 3055 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3216 Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 980 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4012 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3144 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2136 Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2788 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2644 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3284 Thread sleep time: -720000s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -2400000s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3620 Thread sleep count: 1507 > 30
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3704 Thread sleep count: 8309 > 30
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -1200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -40064s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -199876s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -99984s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -99968s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -99969s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -99891s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -99906s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -79928s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -79700s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -240189s >= -30000s
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe TID: 3728 Thread sleep time: -159970s >= -30000s
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3716 Thread sleep time: -120000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 1200000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 1200000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 59383 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 40611 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 38635 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Thread delayed: delay time: 61358 Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 40064
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 99938
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 99984
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 99968
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 99969
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 99891
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 99906
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 79928
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 80063
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Thread delayed: delay time: 79985
Source: dzoihohj75439.scr, 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: vmware
Source: dzoihohj75439.scr, 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Code function: 13_2_001C5348 CheckRemoteDebuggerPresent, 13_2_001C5348
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process queried: DebugPort
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Memory written: C:\Users\user\AppData\Roaming\dzoihohj75439.scr base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Memory written: C:\Users\user\AppData\Roaming\egFUHsL.exe base: 400000 value starts with: 4D5A
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp871B.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Process created: C:\Users\user\AppData\Roaming\dzoihohj75439.scr "C:\Users\user\AppData\Roaming\dzoihohj75439.scr" Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process created: C:\Users\user\AppData\Roaming\egFUHsL.exe C:\Users\user\AppData\Roaming\egFUHsL.exe
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\egFUHsL" /XML "C:\Users\user\AppData\Local\Temp\tmp9A3D.tmp"
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Process created: C:\Users\user\AppData\Roaming\egFUHsL.exe "C:\Users\user\AppData\Roaming\egFUHsL.exe"
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Queries volume information: C:\Users\user\AppData\Roaming\dzoihohj75439.scr VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Queries volume information: C:\Users\user\AppData\Roaming\dzoihohj75439.scr VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Queries volume information: C:\Users\user\AppData\Roaming\egFUHsL.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Queries volume information: C:\Users\user\AppData\Roaming\egFUHsL.exe VolumeInformation
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 5.2.dzoihohj75439.scr.3419a00.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzoihohj75439.scr.33de1e0.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.dzoihohj75439.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzoihohj75439.scr.3419a00.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dzoihohj75439.scr PID: 3456, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dzoihohj75439.scr PID: 3788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: egFUHsL.exe PID: 312, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File opened: C:\FTP Navigator\Ftplist.txt
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Users\user\AppData\Roaming\dzoihohj75439.scr Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Roaming\egFUHsL.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Yara detected Credential Stealer
Source: Yara match File source: 5.2.dzoihohj75439.scr.3419a00.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzoihohj75439.scr.33de1e0.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.dzoihohj75439.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzoihohj75439.scr.3419a00.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dzoihohj75439.scr PID: 3456, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dzoihohj75439.scr PID: 3788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: egFUHsL.exe PID: 312, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 5.2.dzoihohj75439.scr.3419a00.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzoihohj75439.scr.33de1e0.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.dzoihohj75439.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzoihohj75439.scr.33de1e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.dzoihohj75439.scr.3419a00.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.718122401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.718596214.0000000002351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.718610223.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361580935.00000000033DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dzoihohj75439.scr PID: 3456, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dzoihohj75439.scr PID: 3788, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: egFUHsL.exe PID: 312, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1427896 Sample: Remittance 17042024.doc Startdate: 18/04/2024 Architecture: WINDOWS Score: 100 66 Multi AV Scanner detection for domain / URL 2->66 68 Found malware configuration 2->68 70 Malicious sample detected (through community Yara rule) 2->70 72 17 other signatures 2->72 8 WINWORD.EXE 336 14 2->8         started        10 taskeng.exe 2->10         started        process3 process4 12 EQNEDT32.EXE 11 8->12         started        17 EQNEDT32.EXE 8->17         started        19 egFUHsL.exe 10->19         started        dnsIp5 64 covid19help.top 104.21.83.128, 443, 49161 CLOUDFLARENETUS United States 12->64 48 C:\Users\user\AppData\...\dzoihohj75439.scr, PE32 12->48 dropped 50 C:\Users\user\...\JBNvj66BwYU3yCv[1].scr, PE32 12->50 dropped 98 Installs new ROOT certificates 12->98 100 Office equation editor establishes network connection 12->100 102 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 12->102 21 dzoihohj75439.scr 5 12->21         started        104 Multi AV Scanner detection for dropped file 19->104 106 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 19->106 108 Machine Learning detection for dropped file 19->108 110 2 other signatures 19->110 25 egFUHsL.exe 19->25         started        28 powershell.exe 19->28         started        30 powershell.exe 19->30         started        32 schtasks.exe 19->32         started        file6 signatures7 process8 dnsIp9 44 C:\Users\user\AppData\Roaming\egFUHsL.exe, PE32 21->44 dropped 46 C:\Users\user\AppData\Local\...\tmp871B.tmp, XML 21->46 dropped 82 Multi AV Scanner detection for dropped file 21->82 84 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 21->84 86 Machine Learning detection for dropped file 21->86 94 5 other signatures 21->94 34 dzoihohj75439.scr 12 2 21->34         started        38 powershell.exe 4 21->38         started        40 powershell.exe 4 21->40         started        42 2 other processes 21->42 58 smtp.fshpxm.com 25->58 60 208.91.199.223, 587 PUBLIC-DOMAIN-REGISTRYUS United States 25->60 62 3 other IPs or domains 25->62 88 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 25->88 90 Tries to steal Mail credentials (via file / registry access) 25->90 92 Tries to harvest and steal ftp login credentials 25->92 96 2 other signatures 25->96 file10 signatures11 process12 dnsIp13 52 smtp.fshpxm.com 34->52 54 ip-api.com 208.95.112.1, 49162, 49165, 80 TUT-ASUS United States 34->54 56 3 other IPs or domains 34->56 74 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 34->74 76 Tries to steal Mail credentials (via file / registry access) 34->76 78 Installs a global keyboard hook 34->78 80 Installs new ROOT certificates 38->80 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.91.198.143
 us2.smtp.mailhostbox.com United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS false
208.91.199.225
 unknown United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
104.21.83.128
 covid19help.top United States
13335 CLOUDFLARENETUS true
208.91.199.223
 unknown United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
208.91.199.224
 unknown United States
394695 PUBLIC-DOMAIN-REGISTRYUS false

Private

IP
192.168.2.255

Contacted Domains

Name IP Active
us2.smtp.mailhostbox.com 208.91.198.143 true
covid19help.top 104.21.83.128 true
ip-api.com 208.95.112.1 true
smtp.fshpxm.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://covid19help.top/JBNvj66BwYU3yCv.scr true unknown
http://ip-api.com/line/?fields=hosting false
    		high