Source: Invoice.exe, 0000000A.00000002.4154310279.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002C09000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002AEA000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002A96000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.00000000031B4000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.0000000003305000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.00000000033B0000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.0000000003261000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.000000000318B000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1937601550.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4153454103.000000000304B000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4153454103.0000000002FFE000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4153454103.000000000314E000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4153454103.0000000003191000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4153454103.0000000002FDC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://mail.starmech.net |
Source: Invoice.exe, 0000000A.00000002.4154310279.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.00000000029D8000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4147057049.0000000000BD2000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002C09000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.000000000294E000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4199902924.0000000008B2E000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4190838162.00000000061DD000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4192476931.0000000006202000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.00000000028DB000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4192868492.000000000621A000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4201720311.0000000008B86000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4150251612.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002AEA000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4193252475.000000000622C000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002A96000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4216968494.0000000007EB6000.00000004.00000020.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4148031273.00000000014C9000.00000004.00000020.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4148031273.0000000001483000.00000004.00000020.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4191864782.0000000006897000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://r3.i.lencr.org/0W |
Source: Invoice.exe, 0000000A.00000002.4154310279.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.00000000029D8000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4147057049.0000000000BD2000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002C09000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.000000000294E000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4199902924.0000000008B2E000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4190838162.00000000061DD000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4192476931.0000000006202000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.00000000028DB000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4192868492.000000000621A000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4201720311.0000000008B86000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4150251612.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002AEA000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4193252475.000000000622C000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002A96000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4216968494.0000000007EB6000.00000004.00000020.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4148031273.00000000014C9000.00000004.00000020.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4148031273.0000000001483000.00000004.00000020.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4191864782.0000000006897000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://r3.o.lencr.org0 |
Source: Invoice.exe, 00000000.00000002.1709720176.00000000030E6000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002891000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000B.00000002.1752157316.00000000026E6000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000010.00000002.1855539438.0000000002526000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1937601550.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.1936751210.0000000003196000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4153454103.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0 |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.carterandcone.coml |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers/? |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers8 |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers? |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designersG |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fonts.com |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.founder.com.cn/cn |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.founder.com.cn/cn/bThe |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.founder.com.cn/cn/cThe |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.galapagosdesign.com/DPlease |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.goodfont.co.kr |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.jiyu-kobo.co.jp/ |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.sajatypeworks.com |
Source: Invoice.exe, 00000000.00000002.1723003703.0000000005940000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.sakkal.com |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.sandoll.co.kr |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.tiro.com |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.typography.netD |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.urwpp.deDPlease |
Source: Invoice.exe, 00000000.00000002.1723086091.0000000007042000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.zhongyicts.com.cn |
Source: Invoice.exe, 0000000A.00000002.4199556511.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4147057049.0000000000BD2000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4149271573.0000000000BE7000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002C09000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4192615676.000000000620B000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4192868492.000000000621A000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4201720311.0000000008B86000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4150251612.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002AEA000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4193252475.000000000622C000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002A96000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4216968494.0000000007EB6000.00000004.00000020.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4148031273.00000000014C9000.00000004.00000020.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4191864782.0000000006897000.00000004.00000020.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.00000000031B4000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.0000000003305000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.00000000033B0000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.0000000003261000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://x1.c.lencr.org/0 |
Source: Invoice.exe, 0000000A.00000002.4199556511.0000000008B1E000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4147057049.0000000000BD2000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4149271573.0000000000BE7000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002C09000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4192615676.000000000620B000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4201720311.0000000008B86000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4150251612.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002AEA000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4193252475.000000000622C000.00000004.00000020.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002A96000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4216968494.0000000007EB6000.00000004.00000020.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4148031273.00000000014C9000.00000004.00000020.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4191864782.0000000006897000.00000004.00000020.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.00000000031B4000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.0000000003305000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.00000000033B0000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.0000000003261000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4216968494.0000000007E80000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://x1.i.lencr.org/0 |
Source: Invoice.exe, 00000000.00000002.1711744311.0000000004847000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000B.00000002.1756637194.00000000040EE000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000B.00000002.1756637194.000000000426F000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1933061893.0000000000402000.00000040.00000400.00020000.00000000.sdmp |
String found in binary or memory: https://account.dyn.com/ |
Source: Invoice.exe, 00000000.00000002.1711744311.0000000004847000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 0000000A.00000002.4154310279.0000000002891000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000B.00000002.1756637194.00000000040EE000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000B.00000002.1756637194.000000000426F000.00000004.00000800.00020000.00000000.sdmp, kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1937601550.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1933061893.0000000000402000.00000040.00000400.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4153454103.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.ipify.org |
Source: kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1937601550.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4153454103.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.ipify.org/ |
Source: kaJNzBnxbXm.exe, 0000000F.00000002.4154923475.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000014.00000002.1937601550.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4153454103.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.ipify.org/t |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_0155D2A4 |
0_2_0155D2A4 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A23E0 |
0_2_078A23E0 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A20C8 |
0_2_078A20C8 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078AC780 |
0_2_078AC780 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078AC772 |
0_2_078AC772 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A1688 |
0_2_078A1688 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A1441 |
0_2_078A1441 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A1450 |
0_2_078A1450 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078AE3B8 |
0_2_078AE3B8 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A23D1 |
0_2_078A23D1 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A0219 |
0_2_078A0219 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A0228 |
0_2_078A0228 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078AF250 |
0_2_078AF250 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078AF260 |
0_2_078AF260 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A20B8 |
0_2_078A20B8 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A10D1 |
0_2_078A10D1 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A10E0 |
0_2_078A10E0 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A300F |
0_2_078A300F |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A0006 |
0_2_078A0006 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A3060 |
0_2_078A3060 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A3070 |
0_2_078A3070 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A5F61 |
0_2_078A5F61 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A5F70 |
0_2_078A5F70 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078AED68 |
0_2_078AED68 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078ACBB8 |
0_2_078ACBB8 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A490E |
0_2_078A490E |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 0_2_078A4910 |
0_2_078A4910 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 10_2_00ED41F8 |
10_2_00ED41F8 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 10_2_00ED4AC8 |
10_2_00ED4AC8 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 10_2_00EDEB71 |
10_2_00EDEB71 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 10_2_00ED3EB0 |
10_2_00ED3EB0 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 10_2_06696618 |
10_2_06696618 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 10_2_066934A0 |
10_2_066934A0 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 10_2_066955E0 |
10_2_066955E0 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 10_2_06697DA0 |
10_2_06697DA0 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 10_2_066976C0 |
10_2_066976C0 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 10_2_0669E3D0 |
10_2_0669E3D0 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 10_2_06690040 |
10_2_06690040 |
Source: C:\Users\user\Desktop\Invoice.exe |
Code function: 10_2_06695D07 |
10_2_06695D07 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_00A6D2A4 |
11_2_00A6D2A4 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C223E0 |
11_2_06C223E0 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C220C8 |
11_2_06C220C8 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C21688 |
11_2_06C21688 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C2C780 |
11_2_06C2C780 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C2C772 |
11_2_06C2C772 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C21441 |
11_2_06C21441 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C21450 |
11_2_06C21450 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C2F25C |
11_2_06C2F25C |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C2F260 |
11_2_06C2F260 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C20219 |
11_2_06C20219 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C20228 |
11_2_06C20228 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C223D1 |
11_2_06C223D1 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C2E3B8 |
11_2_06C2E3B8 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C210D1 |
11_2_06C210D1 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C210E0 |
11_2_06C210E0 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C220B8 |
11_2_06C220B8 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C23060 |
11_2_06C23060 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C23070 |
11_2_06C23070 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C25F61 |
11_2_06C25F61 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C25F70 |
11_2_06C25F70 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C2ED68 |
11_2_06C2ED68 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C2CBB8 |
11_2_06C2CBB8 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C2490F |
11_2_06C2490F |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 11_2_06C24910 |
11_2_06C24910 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_02F041F8 |
15_2_02F041F8 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_02F04AC8 |
15_2_02F04AC8 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_02F0EB71 |
15_2_02F0EB71 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_02F03EB0 |
15_2_02F03EB0 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_02F0ADF8 |
15_2_02F0ADF8 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_06BC0A5C |
15_2_06BC0A5C |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_06BC2008 |
15_2_06BC2008 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_06BC2007 |
15_2_06BC2007 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_06BC2CF2 |
15_2_06BC2CF2 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_06BD6618 |
15_2_06BD6618 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_06BD34A0 |
15_2_06BD34A0 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_06BD7DA0 |
15_2_06BD7DA0 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_06BD55E0 |
15_2_06BD55E0 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_06BD76C0 |
15_2_06BD76C0 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_06BD5D18 |
15_2_06BD5D18 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_06BDE3D0 |
15_2_06BDE3D0 |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Code function: 15_2_06BD0040 |
15_2_06BD0040 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_007DD2A4 |
16_2_007DD2A4 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D23E0 |
16_2_068D23E0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D20C8 |
16_2_068D20C8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D1688 |
16_2_068D1688 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068DC780 |
16_2_068DC780 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068DC76D |
16_2_068DC76D |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D1441 |
16_2_068D1441 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D1450 |
16_2_068D1450 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D0219 |
16_2_068D0219 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D0228 |
16_2_068D0228 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068DF25C |
16_2_068DF25C |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068DF260 |
16_2_068DF260 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068DE3B8 |
16_2_068DE3B8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D23D1 |
16_2_068D23D1 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D20B8 |
16_2_068D20B8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D10D1 |
16_2_068D10D1 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D10E0 |
16_2_068D10E0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D3060 |
16_2_068D3060 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D3070 |
16_2_068D3070 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D5F61 |
16_2_068D5F61 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D5F70 |
16_2_068D5F70 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068DED68 |
16_2_068DED68 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068DCBB8 |
16_2_068DCBB8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D490E |
16_2_068D490E |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 16_2_068D4910 |
16_2_068D4910 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_00EBA510 |
20_2_00EBA510 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_00EB4AC8 |
20_2_00EB4AC8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_00EBACD8 |
20_2_00EBACD8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_00EB3EB0 |
20_2_00EB3EB0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_00EB41F8 |
20_2_00EB41F8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_06866618 |
20_2_06866618 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_068634A0 |
20_2_068634A0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_06867DA0 |
20_2_06867DA0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_068655E0 |
20_2_068655E0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_068676C0 |
20_2_068676C0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_06865D18 |
20_2_06865D18 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_0686E3D0 |
20_2_0686E3D0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_06860040 |
20_2_06860040 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_06951DA1 |
20_2_06951DA1 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_06951DC8 |
20_2_06951DC8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 20_2_06860007 |
20_2_06860007 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_02DAD2A4 |
24_2_02DAD2A4 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_05568D08 |
24_2_05568D08 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_05560040 |
24_2_05560040 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_05560006 |
24_2_05560006 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_05568CF9 |
24_2_05568CF9 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_074223E0 |
24_2_074223E0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_074220C8 |
24_2_074220C8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_0742C77A |
24_2_0742C77A |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_0742C780 |
24_2_0742C780 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_07421688 |
24_2_07421688 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_07421441 |
24_2_07421441 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_07421450 |
24_2_07421450 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_074223D1 |
24_2_074223D1 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_0742E3B8 |
24_2_0742E3B8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_0742F250 |
24_2_0742F250 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_0742F260 |
24_2_0742F260 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_07420219 |
24_2_07420219 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_07420228 |
24_2_07420228 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_07423060 |
24_2_07423060 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_07423070 |
24_2_07423070 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_0742300F |
24_2_0742300F |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_074210D1 |
24_2_074210D1 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_074210E0 |
24_2_074210E0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_074220B8 |
24_2_074220B8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_07425F61 |
24_2_07425F61 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_07425F70 |
24_2_07425F70 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_07425F0F |
24_2_07425F0F |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_0742ED68 |
24_2_0742ED68 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_0742CBB8 |
24_2_0742CBB8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_07424901 |
24_2_07424901 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_07424910 |
24_2_07424910 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_074A36B0 |
24_2_074A36B0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 24_2_074A52A8 |
24_2_074A52A8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 27_2_02EF41F8 |
27_2_02EF41F8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 27_2_02EF4AC8 |
27_2_02EF4AC8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 27_2_02EF3EB0 |
27_2_02EF3EB0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 27_2_02EFEB33 |
27_2_02EFEB33 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 27_2_06D234A0 |
27_2_06D234A0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 27_2_06D276C0 |
27_2_06D276C0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 27_2_06D20040 |
27_2_06D20040 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 27_2_06E1EAC0 |
27_2_06E1EAC0 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 27_2_06E11DC3 |
27_2_06E11DC3 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 27_2_06E11DC8 |
27_2_06E11DC8 |
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Code function: 27_2_06D2003E |
27_2_06D2003E |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: dwrite.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: windowscodecs.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: edputil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: appresolver.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: bcp47langs.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: slc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: sppc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: atl.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msisip.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wshext.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: appxsip.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: opcservices.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: microsoft.management.infrastructure.native.unmanaged.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: miutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wmidcom.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: atl.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msisip.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wshext.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: appxsip.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: opcservices.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: microsoft.management.infrastructure.native.unmanaged.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: miutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wmidcom.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: rasapi32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: rasman.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: rtutils.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: vaultcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: edputil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Section loaded: windowscodecs.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: mscoree.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: apphelp.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: version.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: vcruntime140_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: ucrtbase_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: uxtheme.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: windows.storage.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: wldp.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: profapi.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: cryptsp.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: rsaenh.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: cryptbase.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: dwrite.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: amsi.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: userenv.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: msasn1.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: gpapi.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: windowscodecs.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: propsys.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: edputil.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: urlmon.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: iertutil.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: srvcli.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: netutils.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: windows.staterepositoryps.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: wintypes.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: appresolver.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: bcp47langs.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: slc.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: sppc.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: onecorecommonproxystub.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: onecoreuapcommonproxystub.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: fastprox.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: ncobjapi.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: wbemcomn.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: wbemcomn.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: mpclient.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: userenv.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: version.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: msasn1.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: wmitomi.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: mi.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: miutils.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: miutils.dll |
|
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: gpapi.dll |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: mscoree.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: version.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: vcruntime140_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: ucrtbase_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: ucrtbase_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: uxtheme.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: windows.storage.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: wldp.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: profapi.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: cryptsp.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: rsaenh.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: cryptbase.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: wbemcomn.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: amsi.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: userenv.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: rasapi32.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: rasman.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: rtutils.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: mswsock.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: winhttp.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: ondemandconnroutehelper.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: iphlpapi.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: dhcpcsvc6.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: dhcpcsvc.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: dnsapi.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: winnsi.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: rasadhlp.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: fwpuclnt.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: secur32.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: schannel.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: mskeyprotect.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: ntasn1.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: ncrypt.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: ncryptsslp.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: msasn1.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: gpapi.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: ntmarta.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: vaultcli.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: wintypes.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: edputil.dll |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Section loaded: windowscodecs.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: mscoree.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: apphelp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: version.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: vcruntime140_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ucrtbase_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ucrtbase_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: uxtheme.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: windows.storage.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: wldp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: profapi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: cryptsp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: rsaenh.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: cryptbase.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: dwrite.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: amsi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: userenv.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: msasn1.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: gpapi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: windowscodecs.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: propsys.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: edputil.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: urlmon.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: iertutil.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: srvcli.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: netutils.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: windows.staterepositoryps.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: wintypes.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: appresolver.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: bcp47langs.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: slc.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: sppc.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: onecorecommonproxystub.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: onecoreuapcommonproxystub.dll |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: mscoree.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: version.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: vcruntime140_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ucrtbase_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ucrtbase_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: uxtheme.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: windows.storage.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: wldp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: profapi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: cryptsp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: rsaenh.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: cryptbase.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: wbemcomn.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: amsi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: userenv.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: rasapi32.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: rasman.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: rtutils.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: mswsock.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: winhttp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ondemandconnroutehelper.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: iphlpapi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: dhcpcsvc6.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: dhcpcsvc.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: dnsapi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: winnsi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: rasadhlp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: fwpuclnt.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: secur32.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: schannel.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: mskeyprotect.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ntasn1.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ncrypt.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ncryptsslp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: msasn1.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: gpapi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: vaultcli.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: wintypes.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: edputil.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: mscoree.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: version.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: vcruntime140_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ucrtbase_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: uxtheme.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: windows.storage.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: wldp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: profapi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: cryptsp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: rsaenh.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: cryptbase.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: dwrite.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: amsi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: userenv.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: msasn1.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: gpapi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: windowscodecs.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: propsys.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: edputil.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: urlmon.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: iertutil.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: srvcli.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: netutils.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: windows.staterepositoryps.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: wintypes.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: appresolver.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: bcp47langs.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: slc.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: sppc.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: onecorecommonproxystub.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: onecoreuapcommonproxystub.dll |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: mscoree.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: kernel.appcore.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: version.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: vcruntime140_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ucrtbase_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ucrtbase_clr0400.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: uxtheme.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: windows.storage.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: wldp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: profapi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: cryptsp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: rsaenh.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: cryptbase.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: wbemcomn.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: amsi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: userenv.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: rasapi32.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: rasman.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: rtutils.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: mswsock.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: winhttp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ondemandconnroutehelper.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: iphlpapi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: dhcpcsvc6.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: dhcpcsvc.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: dnsapi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: winnsi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: rasadhlp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: fwpuclnt.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: secur32.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: schannel.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: mskeyprotect.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ntasn1.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ncrypt.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: ncryptsslp.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: msasn1.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: gpapi.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: vaultcli.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: wintypes.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: edputil.dll |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Section loaded: windowscodecs.dll |
|
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, UiJ0ge5mBiTTGJJUcf.cs |
High entropy of concatenated method names: 'TpR6gsBqAZ', 'fCF6m1Nl1s', 'iYJ6xraGvh', 'UiU6UTdIlD', 'a5l6jhmD3L', 'I716p81Qo0', 'FhU6DweTfC', 'q0k6QPmbTc', 'la76SBKYFt', 'rgw67YKeb0' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, EIBrmQl3fCwRQx0Nkx.cs |
High entropy of concatenated method names: 'ew6JI4DxIb', 'iU4J6eSTuZ', 'TGyJ0ilrw9', 'cJSJ2PeqtM', 'VUTJT6BjJY', 'Sb10jBo1od', 'Vyl0pVyVbW', 'n9F0DSfkoF', 'nE20QFSu7K', 'UQF0SO9aoY' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, q5gbWaDChjkFBUGIKJ.cs |
High entropy of concatenated method names: 'BwZHbU9phb', 'FCZHPIRRNV', 'jlgHhuMx5p', 'qxhHObL6m8', 'S3tH6jT4QX', 'wOAH09338o', 'Cp5HJANYro', 'lX3ZDGFmvR', 'do9ZQFQ7iq', 'BVHZSe5Qq9' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, B2CBtvPEkNk3k5h3BTp.cs |
High entropy of concatenated method names: 'aEc9ABqTwJ', 'cHk9XF3knD', 'VG59uTqBPR', 'as0AQ73vgwRNxDUHCsN', 'nIuD5Q3RDRp5mfxO7Qo', 'bEqRIl3Zp6pOpmShaIZ', 'VYdOxT3PQNNV7jMrlcQ', 'gck3f13EKnGeS4fi52s' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, taTHaguIgLY3bM3hhE.cs |
High entropy of concatenated method names: 'D2A2ANN9Gl', 'R702XtKD5R', 'KwW2u4G8h3', 'FFF2YoD6eh', 'CvE2R6rpU7', 'EJi28SJKu5', 'X9t25VsQOn', 'RGf2rESRT4', 'Ucv2yU2Gfq', 'fVc2WAOZ2e' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, YWGrgKGrr9dgIDORMf.cs |
High entropy of concatenated method names: 'gO0ZO0aXRN', 'YVTZ6qfaK3', 'utYZw6bNqh', 'xNUZ0RT8JQ', 's4qZJwNSwQ', 'W3sZ2rjsZG', 'NQQZTE8upc', 'SMdZ3HD63M', 'lmhZc8W6PL', 'eXUZqBLKap' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, Cju3rjOQSNtJwaqocK.cs |
High entropy of concatenated method names: 'dMFfFRlq0W', 'CbffNWqmcf', 'pfLfgs2b9r', 'GNKfmwk1FR', 'he8fvjBRsI', 'hFWfaJEMbD', 'nSafBnBlFD', 'J0IflOxdwZ', 'HxWfV2HZ78', 'TqcfLsa8nD' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, tF3NE49dN1fHmfE2OM.cs |
High entropy of concatenated method names: 'ToString', 'xAPC1VhrNA', 'L9sCvXB3S0', 'kZKCaGZ137', 'ldICBDbRKp', 'oJMClwPEuc', 'kBnCVJT4pw', 'b1jCLmawBF', 'CCpCeOd9XR', 'UQsCk8Imn6' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, QriRWWw2UTSFFcnJ3R.cs |
High entropy of concatenated method names: 'Won0RgHcx8', 'QcP05Y3wW8', 'S87waWsZUn', 'xRZwBx25Xv', 'kqDwlZqvmB', 'gD7wVwZ7UE', 'yalwLCGmOr', 'fDAweqqm2b', 'MOywk14igG', 'zNRwFUmSYL' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, mjqmK2PWR2NhJ0H8KYh.cs |
High entropy of concatenated method names: 'UnhHAWlopU', 'kSDHXNG0J5', 'oWGHuVe299', 'P3GHYKdifH', 'S4oHRYAZwy', 'llYH8k58w5', 'FvJH5TdGrF', 'mhXHrQ00SY', 'ImpHyKAsK2', 'cwrHWrOw4F' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, yLesXSPc0cbmVTvpmR9.cs |
High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'rZw9gcQNRU', 'HF79m0fG7Y', 'HPe9xSic5F', 'HmC9UqDx9H', 'qZb9jD76pb', 'm4q9pI4aEC', 'iRf9Dk8UXH' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, fvPGMvAj9tCAVAEDOT.cs |
High entropy of concatenated method names: 'f8RKrqp5YQ', 'HPAKyX4GtF', 'r7SKGRiZYJ', 'RPhKvCm5xg', 'pghKBD8feY', 'vY8KlkWNjy', 'zOtKLKBcbG', 'OkCKekGjdw', 'iixKFt949U', 'IfgK1A8IEH' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, sorUNDEvWx52xYJOA9.cs |
High entropy of concatenated method names: 'bl5uU08Zj', 'nkDY8bmsM', 'G8e8mnumN', 'kRs5cADvG', 'S9LyI6COL', 'OaaWd8acJ', 'uH36WEEOdRGIgiQnJP', 'RBkMMd1g8efHXaygTf', 'dUnZabLw4', 'a8Q92SUTn' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, NgjgUsfwbse2ujuNr0.cs |
High entropy of concatenated method names: 'zwdwYOS1xD', 'DOWw8Rb6hU', 'SdEwrgmSrA', 'W77wyJGEJm', 'EK8wfmUNOH', 'GKkwCQclIJ', 'nRVwEKv6VU', 'sSGwZulRKA', 'vqPwHeN8I0', 'zXaw978dRB' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, TVxD1PhGaou6QQJ9M8.cs |
High entropy of concatenated method names: 'KcCJi0iHsn', 'CGyJAEpkhL', 'Ho9JuQRE7y', 'DQOJYhDbfU', 'Uh2J8bZpVw', 'CVxJ5CRATi', 'bnYJy4AD8q', 'aClJW9MTBa', 'Rv1kH72Vdq7qamMUi85', 'a1t1Qk2XK2tLTGoeV7e' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, jGxU6uLS0cTcaSem1E.cs |
High entropy of concatenated method names: 'MFVPIXJAkZ', 'knRPOwjm1Q', 'VFjP6F7YN7', 'UprPwv28F8', 'Xj7P0nQ11g', 'BhOPJtdyiS', 'UO3P22x9hk', 'BStPTxLJpr', 'Gk4P3ICkaZ', 'fsNPcGEDYq' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, GEWaMHXNdnbgJXqZYJ.cs |
High entropy of concatenated method names: 'Dispose', 'weubSZdZx2', 'PBonvX7mfn', 'S6ussyAwSb', 'cvdb78ughM', 'oN0bzNSOSI', 'ProcessDialogKey', 'lTDn4BT1bP', 'utQnbAQCci', 'Ruunn8N2W7' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, tCaO0JRP9pPUWx56tL.cs |
High entropy of concatenated method names: 'TYpEQWM8XF', 'D6bE7dwO8T', 'vl6Z4fBiP3', 'BGCZb8ga9M', 'IN4E1ppZHV', 'oGZENrXdsP', 'fKhEtryh8b', 'OqSEg5lr54', 'TvZEmY4Gc0', 'EsdExeLC8p' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, D5GhXczK3CwNgSuY8O.cs |
High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JYLHKwtE9Y', 'pteHfPQqVr', 'Sq5HCtt838', 'PZRHEjp3q0', 'VIZHZUPTNp', 'j4GHHEXPBM', 'YgLH9JN3q4' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, pnH9S8pKmwnqqY7kZo.cs |
High entropy of concatenated method names: 'TB8b2yJeup', 'nx5bTOdFg2', 'niIbceH3E4', 'FRCbqVPkuF', 'oiBbfNVehh', 'gD0bClw2I8', 'LgGeBvJPuQH6dILDbR', 'q7B0IWuCFetuOA29Ad', 'mF0bbfWSgd', 'cwebP625kR' |
Source: 0.2.Invoice.exe.a600000.8.raw.unpack, S2BtbRysTRp7KGSVvm.cs |
High entropy of concatenated method names: 'BhNZGXr3Rn', 'y1EZvm0FqM', 'VkRZav8ZqZ', 'bQIZBffQdX', 'PVyZgQ0GSf', 'NNcZlp3keU', 'Next', 'Next', 'Next', 'NextBytes' |
Source: 0.2.Invoice.exe.3e59970.3.raw.unpack, V4uC3Iifq56IKQcfry.cs |
High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv' |
Source: 0.2.Invoice.exe.3e59970.3.raw.unpack, vpednoN8EZgsJ4TDwx.cs |
High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, UiJ0ge5mBiTTGJJUcf.cs |
High entropy of concatenated method names: 'TpR6gsBqAZ', 'fCF6m1Nl1s', 'iYJ6xraGvh', 'UiU6UTdIlD', 'a5l6jhmD3L', 'I716p81Qo0', 'FhU6DweTfC', 'q0k6QPmbTc', 'la76SBKYFt', 'rgw67YKeb0' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, EIBrmQl3fCwRQx0Nkx.cs |
High entropy of concatenated method names: 'ew6JI4DxIb', 'iU4J6eSTuZ', 'TGyJ0ilrw9', 'cJSJ2PeqtM', 'VUTJT6BjJY', 'Sb10jBo1od', 'Vyl0pVyVbW', 'n9F0DSfkoF', 'nE20QFSu7K', 'UQF0SO9aoY' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, q5gbWaDChjkFBUGIKJ.cs |
High entropy of concatenated method names: 'BwZHbU9phb', 'FCZHPIRRNV', 'jlgHhuMx5p', 'qxhHObL6m8', 'S3tH6jT4QX', 'wOAH09338o', 'Cp5HJANYro', 'lX3ZDGFmvR', 'do9ZQFQ7iq', 'BVHZSe5Qq9' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, B2CBtvPEkNk3k5h3BTp.cs |
High entropy of concatenated method names: 'aEc9ABqTwJ', 'cHk9XF3knD', 'VG59uTqBPR', 'as0AQ73vgwRNxDUHCsN', 'nIuD5Q3RDRp5mfxO7Qo', 'bEqRIl3Zp6pOpmShaIZ', 'VYdOxT3PQNNV7jMrlcQ', 'gck3f13EKnGeS4fi52s' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, taTHaguIgLY3bM3hhE.cs |
High entropy of concatenated method names: 'D2A2ANN9Gl', 'R702XtKD5R', 'KwW2u4G8h3', 'FFF2YoD6eh', 'CvE2R6rpU7', 'EJi28SJKu5', 'X9t25VsQOn', 'RGf2rESRT4', 'Ucv2yU2Gfq', 'fVc2WAOZ2e' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, YWGrgKGrr9dgIDORMf.cs |
High entropy of concatenated method names: 'gO0ZO0aXRN', 'YVTZ6qfaK3', 'utYZw6bNqh', 'xNUZ0RT8JQ', 's4qZJwNSwQ', 'W3sZ2rjsZG', 'NQQZTE8upc', 'SMdZ3HD63M', 'lmhZc8W6PL', 'eXUZqBLKap' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, Cju3rjOQSNtJwaqocK.cs |
High entropy of concatenated method names: 'dMFfFRlq0W', 'CbffNWqmcf', 'pfLfgs2b9r', 'GNKfmwk1FR', 'he8fvjBRsI', 'hFWfaJEMbD', 'nSafBnBlFD', 'J0IflOxdwZ', 'HxWfV2HZ78', 'TqcfLsa8nD' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, tF3NE49dN1fHmfE2OM.cs |
High entropy of concatenated method names: 'ToString', 'xAPC1VhrNA', 'L9sCvXB3S0', 'kZKCaGZ137', 'ldICBDbRKp', 'oJMClwPEuc', 'kBnCVJT4pw', 'b1jCLmawBF', 'CCpCeOd9XR', 'UQsCk8Imn6' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, QriRWWw2UTSFFcnJ3R.cs |
High entropy of concatenated method names: 'Won0RgHcx8', 'QcP05Y3wW8', 'S87waWsZUn', 'xRZwBx25Xv', 'kqDwlZqvmB', 'gD7wVwZ7UE', 'yalwLCGmOr', 'fDAweqqm2b', 'MOywk14igG', 'zNRwFUmSYL' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, mjqmK2PWR2NhJ0H8KYh.cs |
High entropy of concatenated method names: 'UnhHAWlopU', 'kSDHXNG0J5', 'oWGHuVe299', 'P3GHYKdifH', 'S4oHRYAZwy', 'llYH8k58w5', 'FvJH5TdGrF', 'mhXHrQ00SY', 'ImpHyKAsK2', 'cwrHWrOw4F' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, yLesXSPc0cbmVTvpmR9.cs |
High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'rZw9gcQNRU', 'HF79m0fG7Y', 'HPe9xSic5F', 'HmC9UqDx9H', 'qZb9jD76pb', 'm4q9pI4aEC', 'iRf9Dk8UXH' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, fvPGMvAj9tCAVAEDOT.cs |
High entropy of concatenated method names: 'f8RKrqp5YQ', 'HPAKyX4GtF', 'r7SKGRiZYJ', 'RPhKvCm5xg', 'pghKBD8feY', 'vY8KlkWNjy', 'zOtKLKBcbG', 'OkCKekGjdw', 'iixKFt949U', 'IfgK1A8IEH' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, sorUNDEvWx52xYJOA9.cs |
High entropy of concatenated method names: 'bl5uU08Zj', 'nkDY8bmsM', 'G8e8mnumN', 'kRs5cADvG', 'S9LyI6COL', 'OaaWd8acJ', 'uH36WEEOdRGIgiQnJP', 'RBkMMd1g8efHXaygTf', 'dUnZabLw4', 'a8Q92SUTn' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, NgjgUsfwbse2ujuNr0.cs |
High entropy of concatenated method names: 'zwdwYOS1xD', 'DOWw8Rb6hU', 'SdEwrgmSrA', 'W77wyJGEJm', 'EK8wfmUNOH', 'GKkwCQclIJ', 'nRVwEKv6VU', 'sSGwZulRKA', 'vqPwHeN8I0', 'zXaw978dRB' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, TVxD1PhGaou6QQJ9M8.cs |
High entropy of concatenated method names: 'KcCJi0iHsn', 'CGyJAEpkhL', 'Ho9JuQRE7y', 'DQOJYhDbfU', 'Uh2J8bZpVw', 'CVxJ5CRATi', 'bnYJy4AD8q', 'aClJW9MTBa', 'Rv1kH72Vdq7qamMUi85', 'a1t1Qk2XK2tLTGoeV7e' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, jGxU6uLS0cTcaSem1E.cs |
High entropy of concatenated method names: 'MFVPIXJAkZ', 'knRPOwjm1Q', 'VFjP6F7YN7', 'UprPwv28F8', 'Xj7P0nQ11g', 'BhOPJtdyiS', 'UO3P22x9hk', 'BStPTxLJpr', 'Gk4P3ICkaZ', 'fsNPcGEDYq' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, GEWaMHXNdnbgJXqZYJ.cs |
High entropy of concatenated method names: 'Dispose', 'weubSZdZx2', 'PBonvX7mfn', 'S6ussyAwSb', 'cvdb78ughM', 'oN0bzNSOSI', 'ProcessDialogKey', 'lTDn4BT1bP', 'utQnbAQCci', 'Ruunn8N2W7' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, tCaO0JRP9pPUWx56tL.cs |
High entropy of concatenated method names: 'TYpEQWM8XF', 'D6bE7dwO8T', 'vl6Z4fBiP3', 'BGCZb8ga9M', 'IN4E1ppZHV', 'oGZENrXdsP', 'fKhEtryh8b', 'OqSEg5lr54', 'TvZEmY4Gc0', 'EsdExeLC8p' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, D5GhXczK3CwNgSuY8O.cs |
High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JYLHKwtE9Y', 'pteHfPQqVr', 'Sq5HCtt838', 'PZRHEjp3q0', 'VIZHZUPTNp', 'j4GHHEXPBM', 'YgLH9JN3q4' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, pnH9S8pKmwnqqY7kZo.cs |
High entropy of concatenated method names: 'TB8b2yJeup', 'nx5bTOdFg2', 'niIbceH3E4', 'FRCbqVPkuF', 'oiBbfNVehh', 'gD0bClw2I8', 'LgGeBvJPuQH6dILDbR', 'q7B0IWuCFetuOA29Ad', 'mF0bbfWSgd', 'cwebP625kR' |
Source: 0.2.Invoice.exe.4a4f1f0.2.raw.unpack, S2BtbRysTRp7KGSVvm.cs |
High entropy of concatenated method names: 'BhNZGXr3Rn', 'y1EZvm0FqM', 'VkRZav8ZqZ', 'bQIZBffQdX', 'PVyZgQ0GSf', 'NNcZlp3keU', 'Next', 'Next', 'Next', 'NextBytes' |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199953 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199844 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199719 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199610 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199485 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199360 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199235 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199110 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198985 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198860 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198735 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198610 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198485 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198360 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198235 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198110 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1197985 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1197860 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1197735 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1197610 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1197485 |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 922337203685477 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 922337203685477 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199938 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199828 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199717 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199594 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199483 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199375 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199266 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199156 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199047 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198937 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198828 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198717 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198594 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198484 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198375 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198266 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198156 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198046 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1197922 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1197802 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1197672 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1197562 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1197453 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1197344 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 922337203685477 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 922337203685477 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199953 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199843 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199734 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199625 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199515 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199406 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199297 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199187 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199078 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198968 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198859 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198750 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198640 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198531 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198422 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198297 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198187 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198078 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197968 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197859 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197749 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197640 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197531 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197419 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197308 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197200 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 922337203685477 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 922337203685477 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199922 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199812 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199703 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199594 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199484 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199375 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199265 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199156 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199047 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198936 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198828 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198718 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198608 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198497 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198390 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198281 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198172 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198062 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197952 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197844 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197734 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197583 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197468 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197359 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197061 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1196952 |
|
Source: C:\Users\user\Desktop\Invoice.exe TID: 6472 |
Thread sleep time: -922337203685477s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7208 |
Thread sleep count: 4934 > 30 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7392 |
Thread sleep time: -3689348814741908s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7208 |
Thread sleep count: 92 > 30 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7260 |
Thread sleep time: -922337203685477s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7452 |
Thread sleep time: -922337203685477s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7368 |
Thread sleep time: -922337203685477s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -33204139332677172s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -100000s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -99875s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -99752s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -99641s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -99516s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -99406s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -99297s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -99188s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -99063s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -98938s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -98826s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -98717s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -98609s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -98500s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -98374s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -98265s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -98156s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -98047s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -97926s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -97810s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -97684s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -97578s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -97469s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -97334s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -97218s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -97110s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -97000s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -96891s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -96766s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1199953s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1199844s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1199719s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1199610s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1199485s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1199360s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1199235s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1199110s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1198985s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1198860s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1198735s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1198610s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1198485s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1198360s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1198235s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1198110s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1197985s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1197860s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1197735s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1197610s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe TID: 7680 |
Thread sleep time: -1197485s >= -30000s |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7536 |
Thread sleep time: -922337203685477s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -27670116110564310s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -100000s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -99890s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -99772s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -99656s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -99547s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -99437s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -99328s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -99219s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -99106s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -98984s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -98873s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -98763s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -98640s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -98526s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -98406s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -98297s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -98187s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -98078s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -97968s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -97859s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -97750s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -97640s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -97531s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -97421s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -97312s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -97203s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1199938s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1199828s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1199717s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1199594s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1199483s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1199375s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1199266s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1199156s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1199047s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1198937s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1198828s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1198717s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1198594s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1198484s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1198375s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1198266s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1198156s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1198046s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1197922s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1197802s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1197672s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1197562s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1197453s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe TID: 7896 |
Thread sleep time: -1197344s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7980 |
Thread sleep time: -922337203685477s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep count: 35 > 30 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -32281802128991695s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -100000s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6620 |
Thread sleep count: 3628 > 30 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -99875s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -99750s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6620 |
Thread sleep count: 6219 > 30 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -99641s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -99532s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -99407s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -99282s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -99157s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -99047s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -98937s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -98827s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -98719s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -98610s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -98485s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -98360s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -98235s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -98110s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -97985s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -97860s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -97735s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -97610s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -97485s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -97360s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -97235s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1199953s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1199843s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1199734s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1199625s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1199515s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1199406s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1199297s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1199187s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1199078s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1198968s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1198859s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1198750s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1198640s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1198531s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1198422s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1198297s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1198187s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1198078s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1197968s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1197859s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1197749s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1197640s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1197531s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1197419s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1197308s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 6624 |
Thread sleep time: -1197200s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7224 |
Thread sleep time: -922337203685477s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -36893488147419080s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -100000s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -99891s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -99782s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -99657s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -99532s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -99407s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -99282s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -99172s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -99063s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -98938s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -98813s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -98688s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -98563s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -98453s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -98344s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -98219s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -98110s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -97985s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -97860s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -97735s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -97610s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -97485s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -97360s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -97235s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1199922s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1199812s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1199703s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1199594s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1199484s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1199375s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1199265s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1199156s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1199047s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1198936s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1198828s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1198718s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1198608s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1198497s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1198390s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1198281s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1198172s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1198062s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1197952s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1197844s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1197734s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1197583s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1197468s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1197359s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1197061s >= -30000s |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7740 |
Thread sleep time: -1196952s >= -30000s |
|
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 100000 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 99875 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 99752 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 99641 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 99516 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 99406 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 99297 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 99188 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 99063 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 98938 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 98826 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 98717 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 98609 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 98500 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 98374 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 98265 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 98156 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 98047 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 97926 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 97810 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 97684 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 97578 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 97469 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 97334 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 97218 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 97110 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 97000 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 96891 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 96766 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199953 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199844 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199719 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199610 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199485 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199360 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199235 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1199110 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198985 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198860 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198735 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198610 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198485 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198360 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198235 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1198110 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1197985 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1197860 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1197735 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1197610 |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Thread delayed: delay time: 1197485 |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 922337203685477 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 922337203685477 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 100000 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 99890 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 99772 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 99656 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 99547 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 99437 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 99328 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 99219 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 99106 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 98984 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 98873 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 98763 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 98640 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 98526 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 98406 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 98297 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 98187 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 98078 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 97968 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 97859 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 97750 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 97640 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 97531 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 97421 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 97312 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 97203 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199938 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199828 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199717 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199594 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199483 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199375 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199266 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199156 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1199047 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198937 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198828 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198717 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198594 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198484 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198375 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198266 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198156 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1198046 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1197922 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1197802 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1197672 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1197562 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1197453 |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Thread delayed: delay time: 1197344 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 922337203685477 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 922337203685477 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 100000 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99875 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99750 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99641 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99532 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99407 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99282 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99157 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99047 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98937 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98827 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98719 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98610 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98485 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98360 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98235 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98110 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97985 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97860 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97735 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97610 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97485 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97360 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97235 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199953 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199843 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199734 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199625 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199515 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199406 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199297 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199187 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199078 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198968 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198859 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198750 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198640 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198531 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198422 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198297 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198187 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198078 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197968 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197859 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197749 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197640 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197531 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197419 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197308 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197200 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 922337203685477 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 922337203685477 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 100000 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99891 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99782 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99657 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99532 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99407 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99282 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99172 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 99063 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98938 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98813 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98688 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98563 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98453 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98344 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98219 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 98110 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97985 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97860 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97735 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97610 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97485 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97360 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 97235 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199922 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199812 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199703 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199594 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199484 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199375 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199265 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199156 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1199047 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198936 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198828 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198718 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198608 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198497 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198390 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198281 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198172 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1198062 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197952 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197844 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197734 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197583 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197468 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197359 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1197061 |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Thread delayed: delay time: 1196952 |
|
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Users\user\Desktop\Invoice.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Users\user\Desktop\Invoice.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\Invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Queries volume information: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Queries volume information: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\kaJNzBnxbXm.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
|
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
|