Windows Analysis Report
Packing List PDF.bat.exe

Overview

General Information

Sample name: Packing List PDF.bat.exe
Analysis ID: 1432126
MD5: 5a12438b3b4c926c12a9376c7bf13426
SHA1: c3185c6a5e5f07a5befbe4af7131d05634f5d1a3
SHA256: 1a794211deaa0ecb6abc6101d7c1bd61111b4dd2d895ee7ecf78fbf17f4c9ab3
Tags: AgentTeslabatexeInvoice
Infos:

Detection

AgentTesla, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found suspicious QR code URL
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Packing List PDF.bat.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Avira: detection malicious, Label: HEUR/AGEN.1309753
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Avira: detection malicious, Label: HEUR/AGEN.1309753
Found malware configuration
Source: 24.2.BjTxJte.exe.47bfb08.6.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.fascia-arch.com", "Username": "brian@fascia-arch.com", "Password": "HERbertstown1987"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Virustotal: Detection: 41% Perma Link
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Virustotal: Detection: 41% Perma Link
Multi AV Scanner detection for submitted file
Source: Packing List PDF.bat.exe ReversingLabs: Detection: 36%
Source: Packing List PDF.bat.exe Virustotal: Detection: 36% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Packing List PDF.bat.exe Joe Sandbox ML: detected

Phishing
barindex
Found suspicious QR code URL
Source: QR Code extractor URL: http://
Source: QR Code extractor URL: http://
Uses 32bit PE files
Source: Packing List PDF.bat.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49733 version: TLS 1.0
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: Packing List PDF.bat.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 4x nop then jmp 06EB3EAAh 0_2_06EB3549
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 4x nop then jmp 06EB3EAAh 0_2_06EB3378
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 4x nop then jmp 06EB3EAAh 0_2_06EB3667
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 4x nop then jmp 06EB3EAAh 0_2_06EB3491
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 4x nop then jmp 06EB3EAAh 0_2_06EB340F
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 4x nop then jmp 06EB3EAAh 0_2_06EB3399
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 4x nop then jmp 06EB3EAAh 0_2_06EB393E
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 4x nop then jmp 098F314Ah 24_2_098F27E9
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 4x nop then jmp 098F314Ah 24_2_098F2618
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 4x nop then jmp 098F314Ah 24_2_098F2907
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 4x nop then jmp 098F314Ah 24_2_098F2BDF
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 4x nop then jmp 098F314Ah 24_2_098F272C
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 4x nop then jmp 098F314Ah 24_2_098F26AF
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 4x nop then jmp 098F314Ah 24_2_098F2639
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49722 -> 50.87.195.61:587
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 50.87.195.61 50.87.195.61
Source: Joe Sandbox View IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View IP Address: 172.67.74.152 172.67.74.152
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.5:49722 -> 50.87.195.61:587
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49733 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGM3DrrEGIjDy4V0_H3Yjc85slo8hhBKKQ10ZDiDsFUznR22jXujdUr7c3uzDt_B_DWQMzTa2E2wyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-12; NID=513=XLUDzZxOMdVXuOYMhfAbe4bdNk2K2exdFpQnpeTHF3w8Et9_s1MhyGgtvcuJ2SIWE4aCCH9ABgYjTnt--4H-3euCr8x1eBR6pjMAnllj44KLfAs4Jo62xCigsfCuoJSLXRPe-ZXMqCdhpSRtXvo2NPXQbhphJ3GVLSPGf28pqf4
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGM3DrrEGIjCh-Z92sb0-vV99vzjR5lAr82DSiquRDqbOuOzSa8pK8DSxKaDTVvY45j6P2ULr1Z8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-12; NID=513=mMwiw4i0Kg58TTLAfuzRFCNDrdt6qwnOhwTNm1zMsMCP1dGlXLmTa0kzpQcLyF6P50Sf94ZabynScJyuWhwCFMWTpg495oU_fLCrOIoAsVde5D2-m59sw9uOxHKSpJ_FTS1F9OwvnS04IYxy_P3JBoIuP5uc4RIsbcr8pbEEr-U
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oECBsU8SvDWmGwB&MD=GeXZP6XL HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oECBsU8SvDWmGwB&MD=GeXZP6XL HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic DNS traffic detected: DNS query: api.ipify.org
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: mail.fascia-arch.com
Source: unknown HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714135479960&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
Source: Packing List PDF.bat.exe, 00000009.00000002.4479652873.0000000002FFC000.00000004.00000800.00020000.00000000.sdmp, Packing List PDF.bat.exe, 00000009.00000002.4479652873.0000000003014000.00000004.00000800.00020000.00000000.sdmp, Packing List PDF.bat.exe, 00000009.00000002.4479652873.000000000314C000.00000004.00000800.00020000.00000000.sdmp, CmxzrHBB.exe, 00000011.00000002.4479598758.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000017.00000002.4480419660.0000000002F9D000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000017.00000002.4480419660.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000017.00000002.4480419660.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000017.00000002.4480419660.0000000002EC4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000017.00000002.4480419660.000000000306D000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000017.00000002.4480419660.0000000002EAC000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4479020236.0000000003144000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4479020236.00000000031E4000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4479020236.000000000312C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.fascia-arch.com
Source: Packing List PDF.bat.exe, 00000000.00000002.2098296618.000000000280B000.00000004.00000800.00020000.00000000.sdmp, Packing List PDF.bat.exe, 00000000.00000002.2098296618.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, Packing List PDF.bat.exe, 00000009.00000002.4479652873.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, CmxzrHBB.exe, 0000000C.00000002.2225583854.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, CmxzrHBB.exe, 00000011.00000002.4479598758.0000000003341000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000013.00000002.2308900332.0000000003026000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000017.00000002.4480419660.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.2385416569.0000000002ACB000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.2385416569.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4479020236.00000000030B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Packing List PDF.bat.exe, 00000000.00000002.2101387752.00000000044FB000.00000004.00000800.00020000.00000000.sdmp, Packing List PDF.bat.exe, 00000009.00000002.4468382854.0000000000433000.00000040.00000400.00020000.00000000.sdmp, CmxzrHBB.exe, 0000000C.00000002.2227455760.0000000004BBE000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.2392274425.00000000047BF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: Packing List PDF.bat.exe, 00000000.00000002.2101387752.00000000044FB000.00000004.00000800.00020000.00000000.sdmp, Packing List PDF.bat.exe, 00000009.00000002.4479652873.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, Packing List PDF.bat.exe, 00000009.00000002.4468382854.0000000000433000.00000040.00000400.00020000.00000000.sdmp, CmxzrHBB.exe, 0000000C.00000002.2227455760.0000000004BBE000.00000004.00000800.00020000.00000000.sdmp, CmxzrHBB.exe, 00000011.00000002.4479598758.0000000003341000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000017.00000002.4480419660.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000018.00000002.2392274425.00000000047BF000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4479020236.00000000030B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: Packing List PDF.bat.exe, 00000009.00000002.4479652873.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, CmxzrHBB.exe, 00000011.00000002.4479598758.0000000003341000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000017.00000002.4480419660.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4479020236.00000000030B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: Packing List PDF.bat.exe, 00000009.00000002.4479652873.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, CmxzrHBB.exe, 00000011.00000002.4479598758.0000000003341000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 00000017.00000002.4480419660.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4479020236.00000000030B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/t
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49738 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Installs a global keyboard hook
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Packing List PDF.bat.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\CmxzrHBB.exe
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Window created: window name: CLIPBRDWNDCLASS

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 12.2.CmxzrHBB.exe.4bbe350.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 24.2.BjTxJte.exe.47fab28.8.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.CmxzrHBB.exe.4bf9370.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 24.2.BjTxJte.exe.47fab28.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.CmxzrHBB.exe.4bf9370.4.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 24.2.BjTxJte.exe.47bfb08.6.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Packing List PDF.bat.exe.4535ff8.6.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Packing List PDF.bat.exe.4535ff8.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 24.2.BjTxJte.exe.47bfb08.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.CmxzrHBB.exe.4bbe350.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 0_2_00E3D2A4 0_2_00E3D2A4
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 0_2_06EB4961 0_2_06EB4961
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 0_2_06EB6668 0_2_06EB6668
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_015A41F8 9_2_015A41F8
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_015AEBF0 9_2_015AEBF0
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_015A4AC8 9_2_015A4AC8
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_015AADF8 9_2_015AADF8
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_015A3EB0 9_2_015A3EB0
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06CA2750 9_2_06CA2750
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06CA65C8 9_2_06CA65C8
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06CA7D48 9_2_06CA7D48
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06CA5568 9_2_06CA5568
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06CAB1F8 9_2_06CAB1F8
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06CAC138 9_2_06CAC138
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06CA7668 9_2_06CA7668
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06CA5CC0 9_2_06CA5CC0
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06CAE360 9_2_06CAE360
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06CA0040 9_2_06CA0040
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06D91DC8 9_2_06D91DC8
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06D91DC2 9_2_06D91DC2
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_0177D2A4 12_2_0177D2A4
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_056B8D08 12_2_056B8D08
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_056B0040 12_2_056B0040
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_056B0006 12_2_056B0006
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_056B8CF9 12_2_056B8CF9
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C23E0 12_2_074C23E0
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C20C8 12_2_074C20C8
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074CC772 12_2_074CC772
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C1688 12_2_074C1688
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C1441 12_2_074C1441
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C1450 12_2_074C1450
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C23D1 12_2_074C23D1
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C0219 12_2_074C0219
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C0228 12_2_074C0228
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C3060 12_2_074C3060
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C3070 12_2_074C3070
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C0006 12_2_074C0006
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074CF0C2 12_2_074CF0C2
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074CF0D0 12_2_074CF0D0
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C10D1 12_2_074C10D1
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C10E0 12_2_074C10E0
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C20B8 12_2_074C20B8
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C5F61 12_2_074C5F61
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C5F70 12_2_074C5F70
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074CCFE7 12_2_074CCFE7
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074CCFF8 12_2_074CCFF8
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074CEC98 12_2_074CEC98
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074CCBB1 12_2_074CCBB1
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C490E 12_2_074C490E
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_074C4910 12_2_074C4910
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077D2768 12_2_077D2768
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077DEF80 12_2_077DEF80
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077DD320 12_2_077DD320
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077D0040 12_2_077D0040
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077DEF70 12_2_077DEF70
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077D2E80 12_2_077D2E80
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077DD31B 12_2_077DD31B
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077FF580 12_2_077FF580
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077FEB18 12_2_077FEB18
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077F53B8 12_2_077F53B8
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077FE290 12_2_077FE290
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077F49F8 12_2_077F49F8
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077FEFE0 12_2_077FEFE0
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077FD780 12_2_077FD780
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077F6CB8 12_2_077F6CB8
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077F6CAF 12_2_077F6CAF
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077F53B3 12_2_077F53B3
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077F5120 12_2_077F5120
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077F5113 12_2_077F5113
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077F49EF 12_2_077F49EF
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_031541F8 17_2_031541F8
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_03154AC8 17_2_03154AC8
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_03153EB0 17_2_03153EB0
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_0315ADE8 17_2_0315ADE8
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_0315EBEF 17_2_0315EBEF
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06F0B608 17_2_06F0B608
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06F03430 17_2_06F03430
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06F065C8 17_2_06F065C8
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06F05568 17_2_06F05568
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06F07D48 17_2_06F07D48
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06F0B1E8 17_2_06F0B1E8
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06F0C138 17_2_06F0C138
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06F07668 17_2_06F07668
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06F05CAF 17_2_06F05CAF
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06F0E360 17_2_06F0E360
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06F00040 17_2_06F00040
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06FF1DC8 17_2_06FF1DC8
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06FF1DC2 17_2_06FF1DC2
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_02F0D2A4 19_2_02F0D2A4
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_075123E0 19_2_075123E0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_075120C8 19_2_075120C8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_07511688 19_2_07511688
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_07511450 19_2_07511450
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_07511441 19_2_07511441
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_075123D1 19_2_075123D1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_07510219 19_2_07510219
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_07510228 19_2_07510228
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_07513070 19_2_07513070
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_07513060 19_2_07513060
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_07510006 19_2_07510006
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_075110D1 19_2_075110D1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_0751F0D0 19_2_0751F0D0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_0751F0C3 19_2_0751F0C3
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_075110E0 19_2_075110E0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_075120B8 19_2_075120B8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_07515F70 19_2_07515F70
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_07515F61 19_2_07515F61
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_0751CFF8 19_2_0751CFF8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_0751CFE7 19_2_0751CFE7
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_0751EC98 19_2_0751EC98
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_0751CBB1 19_2_0751CBB1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_07514910 19_2_07514910
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_07514901 19_2_07514901
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_02D741F8 23_2_02D741F8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_02D74AC8 23_2_02D74AC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_02D7E9F8 23_2_02D7E9F8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_02D73EB0 23_2_02D73EB0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_02D7ACD8 23_2_02D7ACD8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_068F3438 23_2_068F3438
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_068F65D0 23_2_068F65D0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_068F7D50 23_2_068F7D50
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_068F5570 23_2_068F5570
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_068FB200 23_2_068FB200
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_068FC140 23_2_068FC140
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_068F7670 23_2_068F7670
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_068F5CC8 23_2_068F5CC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_068FE368 23_2_068FE368
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_068F0040 23_2_068F0040
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_069E1DC8 23_2_069E1DC8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_069E1DC2 23_2_069E1DC2
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_068F0007 23_2_068F0007
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_00E7D2A4 24_2_00E7D2A4
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_04F78D08 24_2_04F78D08
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_04F70040 24_2_04F70040
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_04F78CF9 24_2_04F78CF9
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_04F757E0 24_2_04F757E0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_085420C8 24_2_085420C8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_085423E0 24_2_085423E0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_08544910 24_2_08544910
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_0854490E 24_2_0854490E
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_0854CBB1 24_2_0854CBB1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_0854EC98 24_2_0854EC98
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_08545F70 24_2_08545F70
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_08545F61 24_2_08545F61
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_0854CFF8 24_2_0854CFF8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_0854CFE7 24_2_0854CFE7
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_08543070 24_2_08543070
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_08543060 24_2_08543060
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_08540006 24_2_08540006
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_0854300F 24_2_0854300F
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_0854F0D0 24_2_0854F0D0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_085410D1 24_2_085410D1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_0854F0CC 24_2_0854F0CC
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_085410E0 24_2_085410E0
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_085420B8 24_2_085420B8
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_08540219 24_2_08540219
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_08540228 24_2_08540228
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_085423D1 24_2_085423D1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_08541450 24_2_08541450
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_08541441 24_2_08541441
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_08541688 24_2_08541688
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_0854C772 24_2_0854C772
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_098F3C10 24_2_098F3C10
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 24_2_098F5908 24_2_098F5908
Sample file is different than original file name gathered from version info
Source: Packing List PDF.bat.exe, 00000000.00000000.1992311021.000000000048E000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameygo.exe" vs Packing List PDF.bat.exe
Source: Packing List PDF.bat.exe, 00000000.00000002.2093723038.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Packing List PDF.bat.exe
Source: Packing List PDF.bat.exe, 00000000.00000002.2126291868.0000000009E70000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Packing List PDF.bat.exe
Source: Packing List PDF.bat.exe, 00000000.00000002.2098296618.000000000280B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamec0fe0520-5c7a-42ab-a1ed-336010ccc94a.exe4 vs Packing List PDF.bat.exe
Source: Packing List PDF.bat.exe, 00000000.00000002.2101387752.00000000044FB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamec0fe0520-5c7a-42ab-a1ed-336010ccc94a.exe4 vs Packing List PDF.bat.exe
Source: Packing List PDF.bat.exe, 00000000.00000002.2101387752.0000000004197000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Packing List PDF.bat.exe
Source: Packing List PDF.bat.exe, 00000009.00000002.4515429764.0000000006A33000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameygo.exe" vs Packing List PDF.bat.exe
Source: Packing List PDF.bat.exe, 00000009.00000002.4469933000.00000000010F9000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Packing List PDF.bat.exe
Source: Packing List PDF.bat.exe Binary or memory string: OriginalFilenameygo.exe" vs Packing List PDF.bat.exe
Uses 32bit PE files
Source: Packing List PDF.bat.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 12.2.CmxzrHBB.exe.4bbe350.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 24.2.BjTxJte.exe.47fab28.8.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.CmxzrHBB.exe.4bf9370.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 24.2.BjTxJte.exe.47fab28.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.CmxzrHBB.exe.4bf9370.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 24.2.BjTxJte.exe.47bfb08.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Packing List PDF.bat.exe.4535ff8.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Packing List PDF.bat.exe.4535ff8.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 24.2.BjTxJte.exe.47bfb08.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.CmxzrHBB.exe.4bbe350.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: Packing List PDF.bat.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: CmxzrHBB.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.Packing List PDF.bat.exe.37a9970.4.raw.unpack, V4uC3Iifq56IKQcfry.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Packing List PDF.bat.exe.37a9970.4.raw.unpack, V4uC3Iifq56IKQcfry.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Packing List PDF.bat.exe.52f0000.8.raw.unpack, V4uC3Iifq56IKQcfry.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Packing List PDF.bat.exe.52f0000.8.raw.unpack, V4uC3Iifq56IKQcfry.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, UED8nSsSYePQNI2weW.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, UED8nSsSYePQNI2weW.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, voSuBxrqvhvwCGt0IG.cs Security API names: _0020.SetAccessControl
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, voSuBxrqvhvwCGt0IG.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, voSuBxrqvhvwCGt0IG.cs Security API names: _0020.AddAccessRule
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, voSuBxrqvhvwCGt0IG.cs Security API names: _0020.SetAccessControl
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, voSuBxrqvhvwCGt0IG.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, voSuBxrqvhvwCGt0IG.cs Security API names: _0020.AddAccessRule
Source: 0.2.Packing List PDF.bat.exe.27fb850.3.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Packing List PDF.bat.exe.4ee0000.7.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Packing List PDF.bat.exe.2a14374.0.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Packing List PDF.bat.exe.2a03d14.1.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Packing List PDF.bat.exe.280bbf0.2.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: classification engine Classification label: mal100.phis.troj.spyw.evad.winEXE@48/28@4/5
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe File created: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7184:120:WilError_03
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Mutant created: \Sessions\1\BaseNamedObjects\AOuiwYryICQkuBzgtXYDE
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7248:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4424:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3184:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5796:120:WilError_03
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe File created: C:\Users\user\AppData\Local\Temp\tmp233A.tmp Jump to behavior
Source: Packing List PDF.bat.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Packing List PDF.bat.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: BjTxJte.exe.9.dr, CmxzrHBB.exe.0.dr Binary or memory string: UPDATE [AdventureWorksLT2008R2].[SalesLT].[Customer] SET FirstName = @firstName, LastName = @lastName, EmailAddress = @emailAddress, Title = @title, MiddleName = @middleName, Suffix = @suffix, CompanyName = @companyName, SalesPerson = @salesPerson, Phone = @phone, PasswordHash = @passwordHash, PasswordSalt = @passwordSalt, rowguid = @rowguid WHERE CustomerID = @CustomerID;SELECT * FROM [AdventureWorksLT2008R2].[SalesLT].[Customer] WHERE CustomerId = @CustomerID
Source: Packing List PDF.bat.exe ReversingLabs: Detection: 36%
Source: Packing List PDF.bat.exe Virustotal: Detection: 36%
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe File read: C:\Users\user\Desktop\Packing List PDF.bat.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Packing List PDF.bat.exe "C:\Users\user\Desktop\Packing List PDF.bat.exe"
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Packing List PDF.bat.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\CmxzrHBB.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp233A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Users\user\Desktop\Packing List PDF.bat.exe "C:\Users\user\Desktop\Packing List PDF.bat.exe"
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1960,i,13115366367868831849,127431275682310398,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Users\user\AppData\Roaming\CmxzrHBB.exe C:\Users\user\AppData\Roaming\CmxzrHBB.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp5CD8.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process created: C:\Users\user\AppData\Roaming\CmxzrHBB.exe "C:\Users\user\AppData\Roaming\CmxzrHBB.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp7AA1.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp9D6B.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Packing List PDF.bat.exe" Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\CmxzrHBB.exe" Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp233A.tmp" Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Users\user\Desktop\Packing List PDF.bat.exe "C:\Users\user\Desktop\Packing List PDF.bat.exe" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1960,i,13115366367868831849,127431275682310398,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp5CD8.tmp"
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process created: C:\Users\user\AppData\Roaming\CmxzrHBB.exe "C:\Users\user\AppData\Roaming\CmxzrHBB.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp7AA1.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp9D6B.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: Packing List PDF.bat.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Packing List PDF.bat.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.2.Packing List PDF.bat.exe.37a9970.4.raw.unpack, V4uC3Iifq56IKQcfry.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.Packing List PDF.bat.exe.52f0000.8.raw.unpack, V4uC3Iifq56IKQcfry.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: Packing List PDF.bat.exe, Customer.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: CmxzrHBB.exe.0.dr, Customer.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, voSuBxrqvhvwCGt0IG.cs .Net Code: Gm8viAaHw2 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, voSuBxrqvhvwCGt0IG.cs .Net Code: Gm8viAaHw2 System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 0_2_04D39EA0 push eax; mov dword ptr [esp], ecx 0_2_04D39EA4
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_015A0C3D push edi; ret 9_2_015A0CC2
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_015A0C95 push edi; retf 9_2_015A0C3A
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06D980E5 push esp; iretd 9_2_06D980ED
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06D92CCD pushad ; ret 9_2_06D92CCF
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06D92C97 pushad ; ret 9_2_06D92C98
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06D92C2C pushad ; ret 9_2_06D92C2E
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06D92D18 pushad ; ret 9_2_06D92D19
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06D92D02 pushad ; ret 9_2_06D92D03
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06D91658 push cs; retf 9_2_06D9165B
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Code function: 9_2_06D97AC0 push esp; iretd 9_2_06D97AC9
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_0177E920 pushad ; retf 12_2_0177E929
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_05719EA0 push eax; mov dword ptr [esp], ecx 12_2_05719EA4
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_05719E8F push eax; mov dword ptr [esp], ecx 12_2_05719EA4
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_0571A980 push eax; ret 12_2_0571A9B3
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077D1547 push FFFFFF8Bh; iretd 12_2_077D155F
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077D13D2 push FFFFFF8Bh; iretd 12_2_077D13D7
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077DF87D pushad ; retf 12_2_077DF87E
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077DE848 push ds; iretd 12_2_077DE84A
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077DE84B push ds; iretd 12_2_077DE852
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077DF887 pushad ; retf 12_2_077DF888
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 12_2_077FAAB2 push ds; ret 12_2_077FAAB3
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_0315EFA0 push eax; retf 0590h 17_2_0315F085
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_03150C3D push edi; ret 17_2_03150CC2
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06FF80E5 push esp; iretd 17_2_06FF80ED
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06FF1658 push cs; retf 17_2_06FF165B
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Code function: 17_2_06FF7AD0 push esp; iretd 17_2_06FF7AD9
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 19_2_054A9EA0 push eax; mov dword ptr [esp], ecx 19_2_054A9EA4
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_02D7AA28 pushfd ; iretd 23_2_02D7AA29
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_02D70C95 push edi; retf 23_2_02D70C3A
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Code function: 23_2_02D70C3D push edi; ret 23_2_02D70CC2
Source: Packing List PDF.bat.exe Static PE information: section name: .text entropy: 7.966229540077175
Source: CmxzrHBB.exe.0.dr Static PE information: section name: .text entropy: 7.966229540077175
Source: 0.2.Packing List PDF.bat.exe.37a9970.4.raw.unpack, V4uC3Iifq56IKQcfry.cs High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 0.2.Packing List PDF.bat.exe.37a9970.4.raw.unpack, vpednoN8EZgsJ4TDwx.cs High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, GZtNwY1f4B37WpsgRm9.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'N4F6D5eZB7', 'iaC6PKQiyD', 'jcL6O7ipUZ', 'Fjk61K61rh', 'XAn6GB7tsx', 'LAR6VpyPpu', 'bjg6L5bfKc'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, NQTCHD9CQHVeLFMxVU.cs High entropy of concatenated method names: 'hVEaZY0AoN', 'HbbaRniEZV', 'ccpa558bBn', 'VVAa4XAmtZ', 'lkUaQjToPs', 'r3Xasdsuhe', 'V5Z3GQeA8kLBymqDbx', 'akkn7JxACHgLeA9gPK', 'JkGaaCtm5T', 'aE2aSW0X5r'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, ukR26U5gGxNhCahaWQ.cs High entropy of concatenated method names: 'xcVyxUSreX', 'r9pycrriE2', 'Hx7X0Z6jPj', 'vdLXM4Ht4x', 'IZHXbb6bLt', 'WqhXUQmGEt', 'WwyXr5uUcZ', 'PFAXd07u4y', 'C3uX9i6ptW', 'utQXeBcCZw'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, MRJ6VaqbQOpRMkw4tM.cs High entropy of concatenated method names: 'gtnZNknjle', 'BvXZBqxu9p', 'MGvZiWWGrj', 'BdtZTnRLQw', 'F7FZxZBXI3', 'g75ZqFNtk7', 'uGTZcqEVqX', 'GJ4ZmbNnIo', 'HONZnMkHrY', 'vJnZgVccBh'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, GXNUldXKd7aoE6y9Ks.cs High entropy of concatenated method names: 'Dispose', 'M0jau8KaKf', 'FNClwccudO', 'EpVooPBNHc', 'iwOatq0YjY', 'ndZazOFHRu', 'ProcessDialogKey', 'E2Tl7g0wa1', 'JTVlaEVyOe', 'Ekgll5ULHp'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, smsncKl7aHrvmmVQjC.cs High entropy of concatenated method names: 'nNJjhaxSQd', 'G4ajtIVwdI', 'JKIk7Z1XbU', 'oX4kaAWfTb', 'yNIjHtrqcB', 'EvWjCXNqrm', 'mt2jAvCfjS', 'bnWjDp0XrL', 'XsvjP1luql', 'r9sjO5lW0k'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, ahXNw9HYE2AMNyAxgf.cs High entropy of concatenated method names: 'bJPit5Kin', 'xetTeLcCp', 'EeAq9Fwut', 'iWCcU22ih', 'S5QnVR6tp', 'YCjg7ICw0', 'vHnhUbdKpaflcJegbV', 'xKmSmHOhMvjSp4Bvta', 'AcSvYNrxocdFvUJZ0s', 'kExkNIk7f'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, Bi9qbn6xkRFk7MGegg.cs High entropy of concatenated method names: 'P2VQe9rB7c', 'aSvQCLeI5j', 'QahQDlGtXi', 'GuVQPMwVHV', 'g2jQwjIue3', 'h62Q0Cpwib', 'MiRQMCukWR', 'aFvQbuAStC', 'atcQUPVLn3', 'RsSQrTu9dJ'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, gHvwOk11NV2bvbKgMkh.cs High entropy of concatenated method names: 'ToString', 'FJG6SM1TKU', 'Wjq6vELMSZ', 'opK6J9708Y', 'HNp63AkL3V', 'csu68LMr61', 'KOZ6XDhUT8', 'mlM6yelhgF', 'cjODZ8Hl2rEHh44duT6', 'EPaGmkH552qPYG9xLYs'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, voSuBxrqvhvwCGt0IG.cs High entropy of concatenated method names: 'EAoSJUpVTE', 'dTdS3bNwrG', 'lQ8S8pTq5V', 'HeHSXQ8q9o', 'EG7SySiN4p', 'EHdSY5kDjI', 'iEZSZ071Yc', 'W0ESRrMokD', 'SDaSfy0uwl', 'qPdS5uVeew'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, cqwYeOgifeDiH9GiAv.cs High entropy of concatenated method names: 'MGnXTN4OQM', 'oCHXqseMXR', 'htVXmsIUZX', 'vduXnehulr', 'VHAXQ6E444', 'IXtXsBB5ul', 'INWXj1QhZD', 'S7CXkKZmpL', 'Ja5XKlnHEO', 'CDXX6ksVu5'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, qSPQ2MD5SmkZrKjp26.cs High entropy of concatenated method names: 'RyXKa3w1iW', 'espKSOdLnq', 'IEkKve7Ro8', 'SZ2K3pT6wT', 'lquK8l5Mp3', 'S8TKyyNJet', 'nOIKYrjlNT', 'KbUkLYN14w', 'xtjkhpw4FE', 'St1kuMndWa'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, UED8nSsSYePQNI2weW.cs High entropy of concatenated method names: 'ewv8DdSUOR', 'R6H8PbKJ3Q', 'B0c8O3IAo9', 'x3A81Yrdx2', 'YtL8G14TwZ', 'mSG8VCwDwV', 'nNd8Lbl0hP', 'Rcx8h8jyYq', 'xj38uLGIwI', 'VE98tnLcKk'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, ojiHTL7xXDd3DKjOXI.cs High entropy of concatenated method names: 'ToString', 'NogsHFu67S', 'phdswPWoM2', 'zOds0t3mZ4', 'RhmsMmV9oI', 'Q9csb6rgde', 'LfBsUIdMEA', 'gYrsrcMcmK', 'V6Esd39fGf', 'axns9xiqYh'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, e4MZ7uPbvHkqw0jGbj.cs High entropy of concatenated method names: 'z4Skpy1KJn', 'Uqikwqwdgu', 's2Sk0H9dKm', 'KWTkMlEioX', 'xpykDFZAZA', 'k1jkbtgKQJ', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, qnWEKiQF117VNjAOLn.cs High entropy of concatenated method names: 'MmsEmAecYn', 'nFLEnAiSj3', 'r0TEpWs43v', 'OM3EwjEcnx', 'wJEEMENpnw', 'hLYEbveTgc', 'SfaEruOMsQ', 'jlTEdiyjC3', 'UnBEeCJfX1', 'J6lEHCU7Fr'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, qovfK4tlQykrH9Zid6.cs High entropy of concatenated method names: 'CtDYJi74mJ', 'ILAY8sBJ0V', 'nQeYyl8rZa', 'nnfYZpECS7', 'z0kYRmwVlV', 'BG2yGSexR7', 'BXmyVq4nEe', 'e8kyL8nYRm', 'TyJyhuYVdJ', 'a3dyulrEqJ'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, bZVYUESqKCWoGNmrFC.cs High entropy of concatenated method names: 'jDeZ34bqbM', 'USWZX6HCcn', 'uHZZYT1cF4', 'WotYteiFfL', 'vXZYzeNEui', 'DdkZ7SUv1f', 'fLoZaffj4g', 'rhKZlQfDvP', 's9yZSLxxjE', 'Vd4ZvKyMmG'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, RPerEpvwrny7trynCf.cs High entropy of concatenated method names: 'pymk3GGeL8', 'reck8HwKGg', 'ah3kXEDsZx', 'GIskyCU6ws', 'onSkYmqG4h', 'd2EkZEgo0C', 'MWrkRHGrLT', 'RMYkf9GKxe', 'v5Gk5nkRx5', 'vDYk4AbLmJ'
Source: 0.2.Packing List PDF.bat.exe.439f350.5.raw.unpack, uu9DYP10fZ9iuCjrufe.cs High entropy of concatenated method names: 'hniKNiygR2', 'u6oKBieOD0', 'WUfKispUYs', 'HbxKTJusKk', 'hjpKxMmOLI', 'WBSKqbDTq9', 'dh6KcWNcXn', 'YdcKm1gGwl', 'xUvKng5QVL', 'QrkKg2ppSK'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, GZtNwY1f4B37WpsgRm9.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'N4F6D5eZB7', 'iaC6PKQiyD', 'jcL6O7ipUZ', 'Fjk61K61rh', 'XAn6GB7tsx', 'LAR6VpyPpu', 'bjg6L5bfKc'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, NQTCHD9CQHVeLFMxVU.cs High entropy of concatenated method names: 'hVEaZY0AoN', 'HbbaRniEZV', 'ccpa558bBn', 'VVAa4XAmtZ', 'lkUaQjToPs', 'r3Xasdsuhe', 'V5Z3GQeA8kLBymqDbx', 'akkn7JxACHgLeA9gPK', 'JkGaaCtm5T', 'aE2aSW0X5r'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, ukR26U5gGxNhCahaWQ.cs High entropy of concatenated method names: 'xcVyxUSreX', 'r9pycrriE2', 'Hx7X0Z6jPj', 'vdLXM4Ht4x', 'IZHXbb6bLt', 'WqhXUQmGEt', 'WwyXr5uUcZ', 'PFAXd07u4y', 'C3uX9i6ptW', 'utQXeBcCZw'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, MRJ6VaqbQOpRMkw4tM.cs High entropy of concatenated method names: 'gtnZNknjle', 'BvXZBqxu9p', 'MGvZiWWGrj', 'BdtZTnRLQw', 'F7FZxZBXI3', 'g75ZqFNtk7', 'uGTZcqEVqX', 'GJ4ZmbNnIo', 'HONZnMkHrY', 'vJnZgVccBh'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, GXNUldXKd7aoE6y9Ks.cs High entropy of concatenated method names: 'Dispose', 'M0jau8KaKf', 'FNClwccudO', 'EpVooPBNHc', 'iwOatq0YjY', 'ndZazOFHRu', 'ProcessDialogKey', 'E2Tl7g0wa1', 'JTVlaEVyOe', 'Ekgll5ULHp'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, smsncKl7aHrvmmVQjC.cs High entropy of concatenated method names: 'nNJjhaxSQd', 'G4ajtIVwdI', 'JKIk7Z1XbU', 'oX4kaAWfTb', 'yNIjHtrqcB', 'EvWjCXNqrm', 'mt2jAvCfjS', 'bnWjDp0XrL', 'XsvjP1luql', 'r9sjO5lW0k'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, ahXNw9HYE2AMNyAxgf.cs High entropy of concatenated method names: 'bJPit5Kin', 'xetTeLcCp', 'EeAq9Fwut', 'iWCcU22ih', 'S5QnVR6tp', 'YCjg7ICw0', 'vHnhUbdKpaflcJegbV', 'xKmSmHOhMvjSp4Bvta', 'AcSvYNrxocdFvUJZ0s', 'kExkNIk7f'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, Bi9qbn6xkRFk7MGegg.cs High entropy of concatenated method names: 'P2VQe9rB7c', 'aSvQCLeI5j', 'QahQDlGtXi', 'GuVQPMwVHV', 'g2jQwjIue3', 'h62Q0Cpwib', 'MiRQMCukWR', 'aFvQbuAStC', 'atcQUPVLn3', 'RsSQrTu9dJ'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, gHvwOk11NV2bvbKgMkh.cs High entropy of concatenated method names: 'ToString', 'FJG6SM1TKU', 'Wjq6vELMSZ', 'opK6J9708Y', 'HNp63AkL3V', 'csu68LMr61', 'KOZ6XDhUT8', 'mlM6yelhgF', 'cjODZ8Hl2rEHh44duT6', 'EPaGmkH552qPYG9xLYs'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, voSuBxrqvhvwCGt0IG.cs High entropy of concatenated method names: 'EAoSJUpVTE', 'dTdS3bNwrG', 'lQ8S8pTq5V', 'HeHSXQ8q9o', 'EG7SySiN4p', 'EHdSY5kDjI', 'iEZSZ071Yc', 'W0ESRrMokD', 'SDaSfy0uwl', 'qPdS5uVeew'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, cqwYeOgifeDiH9GiAv.cs High entropy of concatenated method names: 'MGnXTN4OQM', 'oCHXqseMXR', 'htVXmsIUZX', 'vduXnehulr', 'VHAXQ6E444', 'IXtXsBB5ul', 'INWXj1QhZD', 'S7CXkKZmpL', 'Ja5XKlnHEO', 'CDXX6ksVu5'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, qSPQ2MD5SmkZrKjp26.cs High entropy of concatenated method names: 'RyXKa3w1iW', 'espKSOdLnq', 'IEkKve7Ro8', 'SZ2K3pT6wT', 'lquK8l5Mp3', 'S8TKyyNJet', 'nOIKYrjlNT', 'KbUkLYN14w', 'xtjkhpw4FE', 'St1kuMndWa'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, UED8nSsSYePQNI2weW.cs High entropy of concatenated method names: 'ewv8DdSUOR', 'R6H8PbKJ3Q', 'B0c8O3IAo9', 'x3A81Yrdx2', 'YtL8G14TwZ', 'mSG8VCwDwV', 'nNd8Lbl0hP', 'Rcx8h8jyYq', 'xj38uLGIwI', 'VE98tnLcKk'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, ojiHTL7xXDd3DKjOXI.cs High entropy of concatenated method names: 'ToString', 'NogsHFu67S', 'phdswPWoM2', 'zOds0t3mZ4', 'RhmsMmV9oI', 'Q9csb6rgde', 'LfBsUIdMEA', 'gYrsrcMcmK', 'V6Esd39fGf', 'axns9xiqYh'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, e4MZ7uPbvHkqw0jGbj.cs High entropy of concatenated method names: 'z4Skpy1KJn', 'Uqikwqwdgu', 's2Sk0H9dKm', 'KWTkMlEioX', 'xpykDFZAZA', 'k1jkbtgKQJ', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, qnWEKiQF117VNjAOLn.cs High entropy of concatenated method names: 'MmsEmAecYn', 'nFLEnAiSj3', 'r0TEpWs43v', 'OM3EwjEcnx', 'wJEEMENpnw', 'hLYEbveTgc', 'SfaEruOMsQ', 'jlTEdiyjC3', 'UnBEeCJfX1', 'J6lEHCU7Fr'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, qovfK4tlQykrH9Zid6.cs High entropy of concatenated method names: 'CtDYJi74mJ', 'ILAY8sBJ0V', 'nQeYyl8rZa', 'nnfYZpECS7', 'z0kYRmwVlV', 'BG2yGSexR7', 'BXmyVq4nEe', 'e8kyL8nYRm', 'TyJyhuYVdJ', 'a3dyulrEqJ'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, bZVYUESqKCWoGNmrFC.cs High entropy of concatenated method names: 'jDeZ34bqbM', 'USWZX6HCcn', 'uHZZYT1cF4', 'WotYteiFfL', 'vXZYzeNEui', 'DdkZ7SUv1f', 'fLoZaffj4g', 'rhKZlQfDvP', 's9yZSLxxjE', 'Vd4ZvKyMmG'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, RPerEpvwrny7trynCf.cs High entropy of concatenated method names: 'pymk3GGeL8', 'reck8HwKGg', 'ah3kXEDsZx', 'GIskyCU6ws', 'onSkYmqG4h', 'd2EkZEgo0C', 'MWrkRHGrLT', 'RMYkf9GKxe', 'v5Gk5nkRx5', 'vDYk4AbLmJ'
Source: 0.2.Packing List PDF.bat.exe.9e70000.9.raw.unpack, uu9DYP10fZ9iuCjrufe.cs High entropy of concatenated method names: 'hniKNiygR2', 'u6oKBieOD0', 'WUfKispUYs', 'HbxKTJusKk', 'hjpKxMmOLI', 'WBSKqbDTq9', 'dh6KcWNcXn', 'YdcKm1gGwl', 'xUvKng5QVL', 'QrkKg2ppSK'
Source: 0.2.Packing List PDF.bat.exe.52f0000.8.raw.unpack, V4uC3Iifq56IKQcfry.cs High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 0.2.Packing List PDF.bat.exe.52f0000.8.raw.unpack, vpednoN8EZgsJ4TDwx.cs High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'
Drops PE files
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe File created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Jump to dropped file
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe File created: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp233A.tmp"
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BjTxJte Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BjTxJte Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe File opened: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe File opened: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe:Zone.Identifier read attributes | delete
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Packing List PDF.bat.exe PID: 5424, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: CmxzrHBB.exe PID: 8048, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BjTxJte.exe PID: 3424, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BjTxJte.exe PID: 1784, type: MEMORYSTR
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: DF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: 27A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: 47A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: 77A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: 87A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: 8960000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: 9960000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: 9EF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: AEF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: BEF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: 1500000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: 2F80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: 1500000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory allocated: 1770000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory allocated: 3140000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory allocated: 5140000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory allocated: 7BC0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory allocated: 8BC0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory allocated: 8D60000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory allocated: 9D60000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory allocated: A3B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory allocated: 7BC0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory allocated: 3150000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory allocated: 3340000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory allocated: 3180000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 2E00000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 2FB0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 2E00000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 79A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 89A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 8B40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 9B40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: A110000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 79A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 2B60000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 2E30000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 2B60000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: E70000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 2A60000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 2950000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 73A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 83A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 8550000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 9550000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 9C40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: AC40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: BC40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 1350000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 30B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory allocated: 2E80000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3627 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5591 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Window / User API: threadDelayed 6007 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Window / User API: threadDelayed 3806 Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Window / User API: threadDelayed 4454
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Window / User API: threadDelayed 5381
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Window / User API: threadDelayed 6201
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Window / User API: threadDelayed 3589
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Window / User API: threadDelayed 5065
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Window / User API: threadDelayed 4747
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 4028 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7244 Thread sleep count: 3627 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7448 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7208 Thread sleep count: 187 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7304 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7504 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7420 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -37815825351104557s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -99881s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -99747s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -99633s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -99500s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -99386s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -99279s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -99165s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -99061s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -98946s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -97719s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -97596s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -97436s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -97280s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -97091s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -96985s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -96874s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -96748s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -96628s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -96500s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -96387s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -96280s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -96172s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -96065s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -95944s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -95828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -95684s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -95575s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -95469s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -95169s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -92325s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -92218s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -92105s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -91994s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -91883s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -91764s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -91656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -91549s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -91422s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -91297s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -91187s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -91077s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -90961s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -90844s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -90734s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -90622s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -90515s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -90406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -90295s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -90187s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -90033s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -88781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -88627s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -88507s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -88366s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -88153s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe TID: 5660 Thread sleep time: -88046s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 4456 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -39660499758475511s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -99755s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -99630s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -99511s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -99404s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -99295s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -99187s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -99077s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -98952s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -98842s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -98734s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -98603s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -96228s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -96106s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -95999s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -95890s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -95781s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -95671s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -95543s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -95437s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -95327s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -95187s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -95073s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -94969s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -94863s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -94735s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -94625s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -94515s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -94405s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -94296s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -94186s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -91533s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -91410s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -91228s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -91108s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -90997s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -90882s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -90777s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -90666s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -90559s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -90453s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -90343s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -90234s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -90122s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -89946s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -89825s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -89656s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -87409s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -87250s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -87125s >= -30000s
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe TID: 7248 Thread sleep time: -87010s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 7372 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -35048813740048126s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -99650s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -99471s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -98016s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -97874s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -97752s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -97538s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -97078s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -96954s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -96847s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -96726s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -96600s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -96469s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -96359s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -96249s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -96110s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -95998s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -95876s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -95750s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -95641s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -95531s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -95400s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -95281s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -95112s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -94958s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -94756s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -93625s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -93360s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -93141s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -92961s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -92844s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -92722s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -92607s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -92498s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -92375s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -92266s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -92156s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -92016s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -91891s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -91766s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -91657s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -91545s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -91422s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -91312s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -91202s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -91080s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -90956s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -90843s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -90719s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -90602s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -90407s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -89417s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -89261s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -89156s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -89046s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -88860s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -88740s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 8092 Thread sleep time: -88610s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 5312 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -32281802128991695s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4128 Thread sleep count: 5065 > 30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -99889s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -99768s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4128 Thread sleep count: 4747 > 30
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -99644s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -99517s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -99391s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -99241s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -99110s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -98121s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -97965s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -97844s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -97734s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -97563s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -97444s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -97329s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -97204s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -97079s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -96964s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -96853s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -96733s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -96624s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -96515s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -96391s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -96266s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -96157s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -96032s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -95907s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -95797s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -95688s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -95563s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -95438s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -95313s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -95188s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -95075s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -94954s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -94829s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -94704s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -94579s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -94454s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -94329s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -94204s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -94079s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -93954s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -93829s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -93704s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -93579s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -93454s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -93329s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -93218s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -93109s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -92984s >= -30000s
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe TID: 4372 Thread sleep time: -92860s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 99881 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 99747 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 99633 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 99500 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 99386 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 99279 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 99165 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 99061 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 98946 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 97719 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 97596 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 97436 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 97280 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 97091 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 96985 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 96874 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 96748 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 96628 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 96500 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 96387 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 96280 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 96172 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 96065 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 95944 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 95828 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 95684 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 95575 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 95469 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 95169 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 92325 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 92218 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 92105 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 91994 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 91883 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 91764 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 91656 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 91549 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 91422 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 91297 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 91187 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 91077 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 90961 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 90844 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 90734 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 90622 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 90515 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 90406 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 90295 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 90187 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 90033 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 88781 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 88627 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 88507 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 88366 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 88153 Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Thread delayed: delay time: 88046 Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 99755
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 99630
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 99511
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 99404
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 99295
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 99187
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 99077
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 98952
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 98842
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 98734
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 98603
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 96228
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 96106
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 95999
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 95890
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 95781
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 95671
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 95543
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 95437
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 95327
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 95187
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 95073
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 94969
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 94863
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 94735
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 94625
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 94515
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 94405
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 94296
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 94186
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 91533
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 91410
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 91228
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 91108
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 90997
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 90882
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 90777
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 90666
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 90559
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 90453
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 90343
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 90234
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 90122
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 89946
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 89825
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 89656
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 87409
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 87250
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 87125
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Thread delayed: delay time: 87010
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 99765
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 99650
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 99471
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 98016
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 97874
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 97752
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 97538
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 97078
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96954
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96847
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96726
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96600
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96469
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96359
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96249
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96110
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95998
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95876
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95750
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95641
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95531
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95400
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95281
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95112
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 94958
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 94756
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 93625
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 93360
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 93141
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 92961
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 92844
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 92722
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 92607
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 92498
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 92375
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 92266
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 92156
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 92016
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 91891
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 91766
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 91657
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 91545
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 91422
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 91312
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 91202
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 91080
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 90956
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 90843
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 90719
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 90602
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 90407
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 89417
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 89261
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 89156
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 89046
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 88860
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 88740
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 88610
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 99889
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 99768
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 99644
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 99517
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 99391
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 99241
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 99110
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 98121
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 97965
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 97844
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 97734
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 97563
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 97444
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 97329
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 97204
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 97079
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96964
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96853
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96733
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96624
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96515
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96391
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96266
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96157
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 96032
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95907
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95797
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95688
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95563
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95438
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95313
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95188
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 95075
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 94954
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 94829
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 94704
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 94579
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 94454
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 94329
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 94204
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 94079
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 93954
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 93829
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 93704
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 93579
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 93454
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 93329
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 93218
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 93109
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 92984
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Thread delayed: delay time: 92860
Source: BjTxJte.exe, 00000013.00000002.2315757771.00000000072E8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\yFS$
Source: Packing List PDF.bat.exe, 00000009.00000002.4473417883.0000000001452000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 00000017.00000002.4516017327.00000000061C0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllt
Source: CmxzrHBB.exe, 0000000C.00000002.2214828370.00000000013E2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: BjTxJte.exe, 00000013.00000002.2315757771.00000000072E8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: CmxzrHBB.exe, 0000000C.00000002.2214828370.00000000013E2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8
Source: CmxzrHBB.exe, 00000011.00000002.4470951720.00000000015D1000.00000004.00000020.00020000.00000000.sdmp, BjTxJte.exe, 0000001B.00000002.4513905229.0000000006690000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Packing List PDF.bat.exe"
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\CmxzrHBB.exe"
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Packing List PDF.bat.exe" Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\CmxzrHBB.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Memory written: C:\Users\user\AppData\Roaming\CmxzrHBB.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory written: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Memory written: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe base: 400000 value starts with: 4D5A
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Packing List PDF.bat.exe" Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\CmxzrHBB.exe" Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp233A.tmp" Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Process created: C:\Users\user\Desktop\Packing List PDF.bat.exe "C:\Users\user\Desktop\Packing List PDF.bat.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp5CD8.tmp"
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Process created: C:\Users\user\AppData\Roaming\CmxzrHBB.exe "C:\Users\user\AppData\Roaming\CmxzrHBB.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp7AA1.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmxzrHBB" /XML "C:\Users\user\AppData\Local\Temp\tmp9D6B.tmp"
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Process created: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe "C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Queries volume information: C:\Users\user\Desktop\Packing List PDF.bat.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Queries volume information: C:\Users\user\Desktop\Packing List PDF.bat.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Queries volume information: C:\Users\user\AppData\Roaming\CmxzrHBB.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Queries volume information: C:\Users\user\AppData\Roaming\CmxzrHBB.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 12.2.CmxzrHBB.exe.4bbe350.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.BjTxJte.exe.47fab28.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.CmxzrHBB.exe.4bf9370.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.BjTxJte.exe.47fab28.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.CmxzrHBB.exe.4bf9370.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.BjTxJte.exe.47bfb08.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.4535ff8.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.4535ff8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.BjTxJte.exe.47bfb08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.CmxzrHBB.exe.4bbe350.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.4479598758.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4479652873.0000000002FFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2227455760.0000000004BBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.4480419660.0000000002EAC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4468382854.0000000000433000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.4479598758.0000000003391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.4479020236.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.2392274425.00000000047BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.4479020236.000000000312C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4479652873.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.4480419660.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2101387752.00000000044FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Packing List PDF.bat.exe PID: 5424, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Packing List PDF.bat.exe PID: 7348, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: CmxzrHBB.exe PID: 8048, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: CmxzrHBB.exe PID: 7264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BjTxJte.exe PID: 6512, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BjTxJte.exe PID: 1784, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BjTxJte.exe PID: 6616, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.37a9970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.52f0000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.52f0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.37a9970.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2125109850.00000000052F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2101387752.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe File opened: C:\FTP Navigator\Ftplist.txt
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\Desktop\Packing List PDF.bat.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\CmxzrHBB.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Yara detected Credential Stealer
Source: Yara match File source: 12.2.CmxzrHBB.exe.4bbe350.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.BjTxJte.exe.47fab28.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.CmxzrHBB.exe.4bf9370.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.BjTxJte.exe.47fab28.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.CmxzrHBB.exe.4bf9370.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.BjTxJte.exe.47bfb08.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.4535ff8.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.4535ff8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.BjTxJte.exe.47bfb08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.CmxzrHBB.exe.4bbe350.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.2227455760.0000000004BBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4468382854.0000000000433000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.4479598758.0000000003391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.4479020236.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.2392274425.00000000047BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4479652873.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.4480419660.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2101387752.00000000044FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Packing List PDF.bat.exe PID: 5424, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Packing List PDF.bat.exe PID: 7348, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: CmxzrHBB.exe PID: 8048, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: CmxzrHBB.exe PID: 7264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BjTxJte.exe PID: 6512, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BjTxJte.exe PID: 1784, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BjTxJte.exe PID: 6616, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 12.2.CmxzrHBB.exe.4bbe350.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.BjTxJte.exe.47fab28.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.CmxzrHBB.exe.4bf9370.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.BjTxJte.exe.47fab28.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.CmxzrHBB.exe.4bf9370.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.BjTxJte.exe.47bfb08.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.4535ff8.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.4535ff8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.BjTxJte.exe.47bfb08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.CmxzrHBB.exe.4bbe350.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.4479598758.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4479652873.0000000002FFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2227455760.0000000004BBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.4480419660.0000000002EAC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4468382854.0000000000433000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.4479598758.0000000003391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.4479020236.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.2392274425.00000000047BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.4479020236.000000000312C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4479652873.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.4480419660.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2101387752.00000000044FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Packing List PDF.bat.exe PID: 5424, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Packing List PDF.bat.exe PID: 7348, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: CmxzrHBB.exe PID: 8048, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: CmxzrHBB.exe PID: 7264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BjTxJte.exe PID: 6512, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BjTxJte.exe PID: 1784, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BjTxJte.exe PID: 6616, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.37a9970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.52f0000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.52f0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Packing List PDF.bat.exe.37a9970.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2125109850.00000000052F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2101387752.00000000037A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1432126 Sample: Packing List PDF.bat.exe Startdate: 26/04/2024 Architecture: WINDOWS Score: 100 66 mail.fascia-arch.com 2->66 68 api.ipify.org 2->68 76 Found malware configuration 2->76 78 Malicious sample detected (through community Yara rule) 2->78 80 Antivirus / Scanner detection for submitted sample 2->80 82 13 other signatures 2->82 8 Packing List PDF.bat.exe 7 2->8         started        12 CmxzrHBB.exe 2->12         started        14 BjTxJte.exe 2->14         started        16 2 other processes 2->16 signatures3 process4 dnsIp5 58 C:\Users\user\AppData\Roaming\CmxzrHBB.exe, PE32 8->58 dropped 60 C:\Users\user\AppData\Local\...\tmp233A.tmp, XML 8->60 dropped 98 Adds a directory exclusion to Windows Defender 8->98 19 Packing List PDF.bat.exe 16 5 8->19         started        24 powershell.exe 23 8->24         started        34 2 other processes 8->34 100 Antivirus detection for dropped file 12->100 102 Multi AV Scanner detection for dropped file 12->102 104 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->104 26 CmxzrHBB.exe 12->26         started        28 schtasks.exe 12->28         started        106 Machine Learning detection for dropped file 14->106 108 Injects a PE file into a foreign processes 14->108 30 BjTxJte.exe 14->30         started        36 2 other processes 14->36 62 192.168.2.5, 138, 443, 49703 unknown unknown 16->62 64 239.255.255.250 unknown Reserved 16->64 32 BjTxJte.exe 16->32         started        38 2 other processes 16->38 file6 signatures7 process8 dnsIp9 70 mail.fascia-arch.com 50.87.195.61, 587 UNIFIEDLAYER-AS-1US United States 19->70 72 api.ipify.org 172.67.74.152, 443, 49707, 49725 CLOUDFLARENETUS United States 19->72 54 C:\Users\user\AppData\Roaming\...\BjTxJte.exe, PE32 19->54 dropped 56 C:\Users\user\...\BjTxJte.exe:Zone.Identifier, ASCII 19->56 dropped 84 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->84 86 Tries to steal Mail credentials (via file / registry access) 19->86 88 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->88 90 Loading BitLocker PowerShell Module 24->90 40 conhost.exe 24->40         started        42 WmiPrvSE.exe 24->42         started        44 conhost.exe 28->44         started        92 Tries to harvest and steal ftp login credentials 32->92 94 Tries to harvest and steal browser information (history, passwords, etc) 32->94 96 Installs a global keyboard hook 32->96 46 conhost.exe 34->46         started        48 conhost.exe 34->48         started        50 conhost.exe 36->50         started        74 www.google.com 142.250.217.228, 443, 49708, 49714 GOOGLEUS United States 38->74 52 conhost.exe 38->52         started        file10 signatures11 process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
239.255.255.250
 unknown Reserved
unknown unknown false
50.87.195.61
 mail.fascia-arch.com United States
46606 UNIFIEDLAYER-AS-1US true
142.250.217.228
 www.google.com United States
15169 GOOGLEUS false
172.67.74.152
 api.ipify.org United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.5

Contacted Domains

Name IP Active
api.ipify.org 172.67.74.152 true
www.google.com 142.250.217.228 true
mail.fascia-arch.com 50.87.195.61 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.ipify.org/ false
    		high
    https://www.google.com/async/ddljson?async=ntp:2 false
      		high
      https://www.google.com/async/newtab_promos false
        		high
        https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw false
          		high
          https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0 false
            		high
            https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGM3DrrEGIjDy4V0_H3Yjc85slo8hhBKKQ10ZDiDsFUznR22jXujdUr7c3uzDt_B_DWQMzTa2E2wyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM false
              		high
              https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGM3DrrEGIjCh-Z92sb0-vV99vzjR5lAr82DSiquRDqbOuOzSa8pK8DSxKaDTVvY45j6P2ULr1Z8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM false
                		high