Windows Analysis Report
SOA.pdf.exe

Overview

General Information

Sample name: SOA.pdf.exe
Analysis ID: 1430339
MD5: 2417cdb09f72141abfa45cb64e699d91
SHA1: 1ddc6b218dd520915ba8933e8214f307387b0e13
SHA256: 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3
Tags: exe
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: CMSTP Execution Process Creation
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses a Windows Living Off The Land Binaries (LOL bins)
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://www.king1122.com/fs83/www.587659.com Avira URL Cloud: Label: malware
Source: http://www.jackandthebox.net/fs83/ Avira URL Cloud: Label: malware
Source: http://www.at-mim.com/fs83/ Avira URL Cloud: Label: malware
Source: http://www.memejseventhall.com/fs83/?lhud=ToNIa34Alsx2v+kP6qveLAZbkLXU5ZMpLFvBeW/RhKMtCd0Ai1yKtBy78SYXuxTiyqZf&2dF=2dedQvcpFjwH0Xi Avira URL Cloud: Label: malware
Source: http://www.memejseventhall.com/fs83/www.buywestlakevillagehomes.com Avira URL Cloud: Label: malware
Source: http://www.askhelpsecur.us Avira URL Cloud: Label: malware
Source: http://www.askhelpsecur.us/fs83/www.sos-soutien.com Avira URL Cloud: Label: malware
Source: http://www.587659.com/fs83/ Avira URL Cloud: Label: malware
Source: http://www.askhelpsecur.us/fs83/ Avira URL Cloud: Label: malware
Source: http://www.id91920.com/fs83/www.naelm.xyz Avira URL Cloud: Label: malware
Source: http://www.587659.com Avira URL Cloud: Label: malware
Source: https://www.memejseventhall.com/fs83/?lhud=ToNIa34Alsx2v Avira URL Cloud: Label: malware
Source: http://www.587659.com/fs83/www.id91920.com Avira URL Cloud: Label: malware
Source: http://www.9831bsej.xyz/fs83/www.wszy.site Avira URL Cloud: Label: phishing
Source: https://www.587659.com/fs83/?lhud=5GSJH6Mn1jrgqi7D7H3i0zORLdOgrVzRX1dcdSf/hg5erqNktMWQo1BKBRhk7zZloV Avira URL Cloud: Label: malware
Source: http://www.king1122.com/fs83/ Avira URL Cloud: Label: malware
Source: http://www.at-mim.com/fs83/.I Avira URL Cloud: Label: malware
Source: http://www.9831bsej.xyz/fs83/ Avira URL Cloud: Label: phishing
Source: http://www.vntapp.net/fs83/ Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000003.00000002.1737185931.0000000000400000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.buywestlakevillagehomes.com/fs83/"], "decoy": ["blastol.space", "tomwalkerisfalco.com", "us-sumatrraslimbellytonic.com", "drywallandpaintingservice.com", "vntapp.net", "passportpages.site", "at-mim.com", "yeondagoods.com", "teomanyildirim.com", "paygame.site", "senze.art", "alhandco.com", "9831bsej.xyz", "traumatic.xyz", "sos-soutien.com", "thetechnolgy.live", "washing-machine-46612.bond", "marvsneakers.com", "shequbaike.net", "xc4f35fg4h35fg4h53.top", "587659.com", "mydiamondsea.com", "purifyelements.com", "key-royalty.com", "aimuzil.fun", "ykautomotives.com", "naelm.xyz", "memejseventhall.com", "opensource.beer", "whiskersfood.com", "piedrajuansebastian.net", "q3cts.baby", "wdfa.xyz", "marketfield.shop", "id91920.com", "22yorkwood.com", "sogracefully.net", "nodoubt2025tour.com", "042024b.vip", "fmegsw.com", "zsqd4i.com", "clashfitness.com", "matrixtech.biz", "ketoxiamejaworks.buzz", "ariostech.com", "cardingforum.co", "comicdesk.xyz", "johnsonforchair.com", "mpower-recruitment.com", "essenceemporium.us", "die-mosaik.schule", "saturnp.com", "tophotoffers.com", "rosamorflorerialima.com", "askhelpsecur.us", "lifestyledbymodigital.com", "clintforcouncil2021.com", "king1122.com", "veterinariaconvet.com.co", "jackandthebox.net", "donderbosgames.com", "wszy.site", "off7979.com", "justklip.com"]}
Multi AV Scanner detection for submitted file
Source: SOA.pdf.exe ReversingLabs: Detection: 47%
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.1737185931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4113294260.0000000003370000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4113244559.0000000003340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4112860100.00000000030A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1679867120.00000000042F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Machine Learning detection for sample
Source: SOA.pdf.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: SOA.pdf.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SOA.pdf.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: cmstp.pdbGCTL source: RegSvcs.exe, 00000003.00000002.1737979318.00000000010E0000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1737704482.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000002.4112710063.0000000000620000.00000040.80000000.00040000.00000000.sdmp
Source: Binary string: RegSvcs.pdb, source: explorer.exe, 00000005.00000002.4125384172.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, cmstp.exe, 00000007.00000002.4113368969.00000000033DB000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000002.4114729451.000000000550F000.00000004.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000003.00000002.1738117014.00000000012D0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000007.00000002.4113903566.000000000515E000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1740249791.0000000004E15000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000002.4113903566.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1737819708.0000000004C62000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000003.00000002.1738117014.00000000012D0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 00000007.00000002.4113903566.000000000515E000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1740249791.0000000004E15000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000002.4113903566.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1737819708.0000000004C62000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: cmstp.pdb source: RegSvcs.exe, 00000003.00000002.1737979318.00000000010E0000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1737704482.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 00000007.00000002.4112710063.0000000000620000.00000040.80000000.00040000.00000000.sdmp
Source: Binary string: RegSvcs.pdb source: explorer.exe, 00000005.00000002.4125384172.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, cmstp.exe, 00000007.00000002.4113368969.00000000033DB000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000002.4114729451.000000000550F000.00000004.10000000.00040000.00000000.sdmp
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062894B memset,memset,memset,SHGetFolderPathW,memset,SHGetFolderPathW,CmFree,memset,FindFirstFileW,GetLastError,memset,memset,FindNextFileW,FindClose, 7_2_0062894B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062B3C4 memset,GetPrivateProfileStringW,FindFirstFileW,memset,FindNextFileW, 7_2_0062B3C4
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4x nop then pop ebx 3_2_00407B1E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4x nop then pop edi 3_2_00417D67
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4x nop then pop edi 3_2_00417D8C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 4x nop then pop ebx 7_2_030A7B1E
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 4x nop then pop edi 7_2_030B7D67
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 4x nop then pop edi 7_2_030B7D8C

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49742 -> 66.96.162.129:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49745 -> 44.219.53.183:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49746 -> 3.33.130.190:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49747 -> 103.251.113.254:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49748 -> 15.197.240.20:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 44.219.53.183 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 66.96.162.129 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.buywestlakevillagehomes.com/fs83/
Performs DNS queries to domains with low reputation
Source: DNS query: www.9831bsej.xyz
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /fs83/?lhud=ToNIa34Alsx2v+kP6qveLAZbkLXU5ZMpLFvBeW/RhKMtCd0Ai1yKtBy78SYXuxTiyqZf&2dF=2dedQvcpFjwH0Xi HTTP/1.1Host: www.memejseventhall.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fs83/?lhud=uoTIvCnC3UdpXVZjGRZ1TpnD0C1ctHvLQTQ5yuyXeiefmGaZCVbnGHhjWY2HlXeR1Arx&2dF=2dedQvcpFjwH0Xi HTTP/1.1Host: www.us-sumatrraslimbellytonic.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fs83/?lhud=fljRqcTCsx7gDvzUPXP5hADTJ24djzjUGdf0diFVPEM3Iw7cK6B2PvBZBUBJzqMuGWq2&2dF=2dedQvcpFjwH0Xi HTTP/1.1Host: www.sos-soutien.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 66.96.162.129 66.96.162.129
Source: Joe Sandbox View IP Address: 44.219.53.183 44.219.53.183
Source: Joe Sandbox View IP Address: 3.33.130.190 3.33.130.190
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: BIZLAND-SDUS BIZLAND-SDUS
Source: Joe Sandbox View ASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox View ASN Name: AMAZONEXPANSIONGB AMAZONEXPANSIONGB
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Windows\explorer.exe Code function: 5_2_11685F82 getaddrinfo,setsockopt,recv, 5_2_11685F82
Source: global traffic HTTP traffic detected: GET /fs83/?lhud=ToNIa34Alsx2v+kP6qveLAZbkLXU5ZMpLFvBeW/RhKMtCd0Ai1yKtBy78SYXuxTiyqZf&2dF=2dedQvcpFjwH0Xi HTTP/1.1Host: www.memejseventhall.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fs83/?lhud=uoTIvCnC3UdpXVZjGRZ1TpnD0C1ctHvLQTQ5yuyXeiefmGaZCVbnGHhjWY2HlXeR1Arx&2dF=2dedQvcpFjwH0Xi HTTP/1.1Host: www.us-sumatrraslimbellytonic.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fs83/?lhud=fljRqcTCsx7gDvzUPXP5hADTJ24djzjUGdf0diFVPEM3Iw7cK6B2PvBZBUBJzqMuGWq2&2dF=2dedQvcpFjwH0Xi HTTP/1.1Host: www.sos-soutien.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.memejseventhall.com
Source: explorer.exe, 00000005.00000003.3111535640.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4119592234.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1690318744.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1684145492.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000005.00000003.3111535640.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4119592234.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1690318744.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1684145492.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000005.00000003.3111535640.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4119592234.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1690318744.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1684145492.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000005.00000003.3111535640.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4119592234.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1690318744.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1684145492.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000005.00000000.1684145492.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000005.00000002.4120783757.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1687674388.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.4118714809.0000000008720000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: SOA.pdf.exe, 00000000.00000002.1676746506.0000000003334000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.587659.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.587659.com/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.587659.com/fs83/www.id91920.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.587659.comReferer:
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.9831bsej.xyz
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.9831bsej.xyz/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.9831bsej.xyz/fs83/www.wszy.site
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.9831bsej.xyzReferer:
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.askhelpsecur.us
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.askhelpsecur.us/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.askhelpsecur.us/fs83/www.sos-soutien.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.askhelpsecur.usReferer:
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.at-mim.com
Source: explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.at-mim.com/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.at-mim.com/fs83/.I
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.at-mim.comReferer:
Source: explorer.exe, 00000005.00000003.3111278251.000000000C9AE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3108583812.000000000C96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3110943260.000000000C9A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1696614258.000000000C964000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3110471166.000000000C974000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.buywestlakevillagehomes.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.buywestlakevillagehomes.com/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.buywestlakevillagehomes.com/fs83/www.us-sumatrraslimbellytonic.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.buywestlakevillagehomes.comReferer:
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.id91920.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.id91920.com/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.id91920.com/fs83/www.naelm.xyz
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.id91920.comReferer:
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jackandthebox.net
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jackandthebox.net/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jackandthebox.net/fs83/www.vntapp.net
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jackandthebox.netReferer:
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.king1122.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.king1122.com/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.king1122.com/fs83/www.587659.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.king1122.comReferer:
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lifestyledbymodigital.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lifestyledbymodigital.com/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lifestyledbymodigital.com/fs83/www.at-mim.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lifestyledbymodigital.comReferer:
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.memejseventhall.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.memejseventhall.com/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.memejseventhall.com/fs83/www.buywestlakevillagehomes.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.memejseventhall.comReferer:
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.naelm.xyz
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.naelm.xyz/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.naelm.xyz/fs83/www.jackandthebox.net
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.naelm.xyzReferer:
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp, SOA.pdf.exe, 00000000.00000002.1683881568.0000000006434000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.sos-soutien.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.sos-soutien.com/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.sos-soutien.com/fs83/www.king1122.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.sos-soutien.comReferer:
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.teomanyildirim.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.teomanyildirim.com/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.teomanyildirim.com/fs83/www.9831bsej.xyz
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.teomanyildirim.comReferer:
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.us-sumatrraslimbellytonic.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.us-sumatrraslimbellytonic.com/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.us-sumatrraslimbellytonic.com/fs83/www.teomanyildirim.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.us-sumatrraslimbellytonic.comReferer:
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.vntapp.net
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.vntapp.net/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.vntapp.net/fs83/www.lifestyledbymodigital.com
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.vntapp.netReferer:
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.wszy.site
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.wszy.site/fs83/
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.wszy.site/fs83/www.askhelpsecur.us
Source: explorer.exe, 00000005.00000003.3105705454.000000000CB41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4124698385.000000000CB4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.wszy.siteReferer:
Source: SOA.pdf.exe, 00000000.00000002.1683983394.0000000007502000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: explorer.exe, 00000005.00000002.4122977847.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1696614258.000000000C893000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000005.00000000.1684145492.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000005.00000000.1684145492.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000005.00000000.1696614258.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4122977847.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000005.00000000.1690318744.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4119592234.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3111535640.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000005.00000000.1690318744.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4119592234.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3111535640.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000005.00000000.1680138963.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4114509814.000000000370D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4113123360.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1681372364.0000000003700000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000005.00000000.1690318744.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3111535640.0000000009701000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4119592234.0000000009702000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1690318744.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4119592234.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3111535640.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000000.1690318744.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3111535640.0000000009701000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4119592234.0000000009702000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000005.00000000.1684145492.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000005.00000000.1684145492.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 00000005.00000000.1696614258.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4122977847.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000005.00000000.1684145492.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: explorer.exe, 00000005.00000000.1696614258.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4122977847.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000005.00000000.1696614258.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4122977847.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000002.4122977847.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1696614258.000000000C557000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000005.00000000.1696614258.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4122977847.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000005.00000002.4125384172.000000001135F000.00000004.80000000.00040000.00000000.sdmp, cmstp.exe, 00000007.00000002.4114729451.00000000059FF000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.587659.com/fs83/?lhud=5GSJH6Mn1jrgqi7D7H3i0zORLdOgrVzRX1dcdSf/hg5erqNktMWQo1BKBRhk7zZloV
Source: explorer.exe, 00000005.00000002.4125384172.000000001135F000.00000004.80000000.00040000.00000000.sdmp, cmstp.exe, 00000007.00000002.4114729451.00000000059FF000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.memejseventhall.com/fs83/?lhud=ToNIa34Alsx2v
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1684145492.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000005.00000002.4116436541.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000005.00000000.1684145492.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.1737185931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4113294260.0000000003370000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4113244559.0000000003340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4112860100.00000000030A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1679867120.00000000042F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.1737185931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.1737185931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.1737185931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.4113294260.0000000003370000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.4113294260.0000000003370000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.4113294260.0000000003370000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.4125730544.000000001169D000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
Source: 00000007.00000002.4113244559.0000000003340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.4113244559.0000000003340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.4113244559.0000000003340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.4112860100.00000000030A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.4112860100.00000000030A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.4112860100.00000000030A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1679867120.00000000042F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.1679867120.00000000042F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.1679867120.00000000042F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: SOA.pdf.exe PID: 6576, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 7100, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: cmstp.exe PID: 7400, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
.NET source code contains very large array initializations
Source: SOA.pdf.exe, TwoPlayersGame.cs Large array initialization: : array initializer size 575223
Source: 0.2.SOA.pdf.exe.3317cb0.7.raw.unpack, HomeView.cs Large array initialization: : array initializer size 33604
Source: 0.2.SOA.pdf.exe.5d30000.10.raw.unpack, HomeView.cs Large array initialization: : array initializer size 33604
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: SOA.pdf.exe
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041A350 NtCreateFile, 3_2_0041A350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041A400 NtReadFile, 3_2_0041A400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041A480 NtClose, 3_2_0041A480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041A530 NtAllocateVirtualMemory, 3_2_0041A530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041A3FA NtReadFile, 3_2_0041A3FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041A52B NtAllocateVirtualMemory, 3_2_0041A52B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342B60 NtClose,LdrInitializeThunk, 3_2_01342B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_01342BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342AD0 NtReadFile,LdrInitializeThunk, 3_2_01342AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342D30 NtUnmapViewOfSection,LdrInitializeThunk, 3_2_01342D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342D10 NtMapViewOfSection,LdrInitializeThunk, 3_2_01342D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342DF0 NtQuerySystemInformation,LdrInitializeThunk, 3_2_01342DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342DD0 NtDelayExecution,LdrInitializeThunk, 3_2_01342DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342C70 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_01342C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342CA0 NtQueryInformationToken,LdrInitializeThunk, 3_2_01342CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342F30 NtCreateSection,LdrInitializeThunk, 3_2_01342F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342FB0 NtResumeThread,LdrInitializeThunk, 3_2_01342FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342F90 NtProtectVirtualMemory,LdrInitializeThunk, 3_2_01342F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342FE0 NtCreateFile,LdrInitializeThunk, 3_2_01342FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342EA0 NtAdjustPrivilegesToken,LdrInitializeThunk, 3_2_01342EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342E80 NtReadVirtualMemory,LdrInitializeThunk, 3_2_01342E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01344340 NtSetContextThread, 3_2_01344340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01344650 NtSuspendThread, 3_2_01344650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342BA0 NtEnumerateValueKey, 3_2_01342BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342B80 NtQueryInformationFile, 3_2_01342B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342BE0 NtQueryValueKey, 3_2_01342BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342AB0 NtWaitForSingleObject, 3_2_01342AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342AF0 NtWriteFile, 3_2_01342AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342D00 NtSetInformationFile, 3_2_01342D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342DB0 NtEnumerateKey, 3_2_01342DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342C00 NtQueryInformationProcess, 3_2_01342C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342C60 NtCreateKey, 3_2_01342C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342CF0 NtOpenProcess, 3_2_01342CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342CC0 NtQueryVirtualMemory, 3_2_01342CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342F60 NtCreateProcessEx, 3_2_01342F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342FA0 NtQuerySection, 3_2_01342FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342E30 NtWriteVirtualMemory, 3_2_01342E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342EE0 NtQueueApcThread, 3_2_01342EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01343010 NtOpenDirectoryObject, 3_2_01343010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01343090 NtSetValueKey, 3_2_01343090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013435C0 NtCreateMutant, 3_2_013435C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013439B0 NtGetContextThread, 3_2_013439B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01343D10 NtOpenProcessToken, 3_2_01343D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01343D70 NtOpenThread, 3_2_01343D70
Source: C:\Windows\explorer.exe Code function: 5_2_11685232 NtCreateFile, 5_2_11685232
Source: C:\Windows\explorer.exe Code function: 5_2_11686E12 NtProtectVirtualMemory, 5_2_11686E12
Source: C:\Windows\explorer.exe Code function: 5_2_11686E0A NtProtectVirtualMemory, 5_2_11686E0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032D10 NtMapViewOfSection,LdrInitializeThunk, 7_2_05032D10
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032DD0 NtDelayExecution,LdrInitializeThunk, 7_2_05032DD0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032DF0 NtQuerySystemInformation,LdrInitializeThunk, 7_2_05032DF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032C60 NtCreateKey,LdrInitializeThunk, 7_2_05032C60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032C70 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_05032C70
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032CA0 NtQueryInformationToken,LdrInitializeThunk, 7_2_05032CA0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032F30 NtCreateSection,LdrInitializeThunk, 7_2_05032F30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032FE0 NtCreateFile,LdrInitializeThunk, 7_2_05032FE0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032EA0 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_05032EA0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032B60 NtClose,LdrInitializeThunk, 7_2_05032B60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032BE0 NtQueryValueKey,LdrInitializeThunk, 7_2_05032BE0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_05032BF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032AD0 NtReadFile,LdrInitializeThunk, 7_2_05032AD0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050335C0 NtCreateMutant,LdrInitializeThunk, 7_2_050335C0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05034650 NtSuspendThread, 7_2_05034650
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05034340 NtSetContextThread, 7_2_05034340
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032D00 NtSetInformationFile, 7_2_05032D00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032D30 NtUnmapViewOfSection, 7_2_05032D30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032DB0 NtEnumerateKey, 7_2_05032DB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032C00 NtQueryInformationProcess, 7_2_05032C00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032CC0 NtQueryVirtualMemory, 7_2_05032CC0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032CF0 NtOpenProcess, 7_2_05032CF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032F60 NtCreateProcessEx, 7_2_05032F60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032F90 NtProtectVirtualMemory, 7_2_05032F90
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032FA0 NtQuerySection, 7_2_05032FA0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032FB0 NtResumeThread, 7_2_05032FB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032E30 NtWriteVirtualMemory, 7_2_05032E30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032E80 NtReadVirtualMemory, 7_2_05032E80
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032EE0 NtQueueApcThread, 7_2_05032EE0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032B80 NtQueryInformationFile, 7_2_05032B80
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032BA0 NtEnumerateValueKey, 7_2_05032BA0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032AB0 NtWaitForSingleObject, 7_2_05032AB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05032AF0 NtWriteFile, 7_2_05032AF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05033010 NtOpenDirectoryObject, 7_2_05033010
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05033090 NtSetValueKey, 7_2_05033090
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05033D10 NtOpenProcessToken, 7_2_05033D10
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05033D70 NtOpenThread, 7_2_05033D70
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050339B0 NtGetContextThread, 7_2_050339B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BA350 NtCreateFile, 7_2_030BA350
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BA530 NtAllocateVirtualMemory, 7_2_030BA530
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BA400 NtReadFile, 7_2_030BA400
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BA480 NtClose, 7_2_030BA480
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BA3FA NtReadFile, 7_2_030BA3FA
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BA52B NtAllocateVirtualMemory, 7_2_030BA52B
Detected potential crypto function
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_0190E26C 0_2_0190E26C
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_07D6C680 0_2_07D6C680
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_07D6B3E0 0_2_07D6B3E0
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_07D622C8 0_2_07D622C8
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_07D622B9 0_2_07D622B9
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_07D6AFA8 0_2_07D6AFA8
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_07D6CF58 0_2_07D6CF58
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_07D63E99 0_2_07D63E99
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_07D60BA0 0_2_07D60BA0
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_07D6AB61 0_2_07D6AB61
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_0A860C90 0_2_0A860C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040102E 3_2_0040102E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041D8E4 3_2_0041D8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00402D92 3_2_00402D92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00409E4D 3_2_00409E4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00409E50 3_2_00409E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041E783 3_2_0041E783
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AA118 3_2_013AA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01300100 3_2_01300100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01398158 3_2_01398158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D01AA 3_2_013D01AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C41A2 3_2_013C41A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C81CC 3_2_013C81CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A2000 3_2_013A2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CA352 3_2_013CA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131E3F0 3_2_0131E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D03E6 3_2_013D03E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013902C0 3_2_013902C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310535 3_2_01310535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D0591 3_2_013D0591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B4420 3_2_013B4420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C2446 3_2_013C2446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013BE4F6 3_2_013BE4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01334750 3_2_01334750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130C7C0 3_2_0130C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132C6E0 3_2_0132C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01326962 3_2_01326962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013DA9A6 3_2_013DA9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131A840 3_2_0131A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01312840 3_2_01312840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012F68B8 3_2_012F68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E8F0 3_2_0133E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CAB40 3_2_013CAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C6BD7 3_2_013C6BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130EA80 3_2_0130EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013ACD1F 3_2_013ACD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131AD00 3_2_0131AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01328DBF 3_2_01328DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130ADE0 3_2_0130ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310C00 3_2_01310C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0CB5 3_2_013B0CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01300CF2 3_2_01300CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01330F30 3_2_01330F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B2F30 3_2_013B2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01352F28 3_2_01352F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01384F40 3_2_01384F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138EFA0 3_2_0138EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01302FC8 3_2_01302FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CEE26 3_2_013CEE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310E59 3_2_01310E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01322E90 3_2_01322E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CCE93 3_2_013CCE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CEEDB 3_2_013CEEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013DB16B 3_2_013DB16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0134516C 3_2_0134516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FF172 3_2_012FF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131B1B0 3_2_0131B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C70E9 3_2_013C70E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CF0E0 3_2_013CF0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013170C0 3_2_013170C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013BF0CC 3_2_013BF0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C132D 3_2_013C132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FD34C 3_2_012FD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0135739A 3_2_0135739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013152A0 3_2_013152A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132D2F0 3_2_0132D2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B12ED 3_2_013B12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132B2C0 3_2_0132B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C7571 3_2_013C7571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AD5B0 3_2_013AD5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D95C3 3_2_013D95C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CF43F 3_2_013CF43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01301460 3_2_01301460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CF7B0 3_2_013CF7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01355630 3_2_01355630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C16CC 3_2_013C16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A5910 3_2_013A5910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01319950 3_2_01319950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132B950 3_2_0132B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137D800 3_2_0137D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013138E0 3_2_013138E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CFB76 3_2_013CFB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132FB80 3_2_0132FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01385BF0 3_2_01385BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0134DBF9 3_2_0134DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01383A6C 3_2_01383A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CFA49 3_2_013CFA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C7A46 3_2_013C7A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01355AA0 3_2_01355AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013ADAAC 3_2_013ADAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B1AA3 3_2_013B1AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013BDAC6 3_2_013BDAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C7D73 3_2_013C7D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C1D5A 3_2_013C1D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01313D40 3_2_01313D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132FDC0 3_2_0132FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01389C32 3_2_01389C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CFCF2 3_2_013CFCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CFF09 3_2_013CFF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CFFB1 3_2_013CFFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01311F92 3_2_01311F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012D3FD5 3_2_012D3FD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012D3FD2 3_2_012D3FD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01319EB0 3_2_01319EB0
Source: C:\Windows\explorer.exe Code function: 5_2_0FC0EB30 5_2_0FC0EB30
Source: C:\Windows\explorer.exe Code function: 5_2_0FC0EB32 5_2_0FC0EB32
Source: C:\Windows\explorer.exe Code function: 5_2_0FC14232 5_2_0FC14232
Source: C:\Windows\explorer.exe Code function: 5_2_0FC175CD 5_2_0FC175CD
Source: C:\Windows\explorer.exe Code function: 5_2_0FC0BD02 5_2_0FC0BD02
Source: C:\Windows\explorer.exe Code function: 5_2_0FC11912 5_2_0FC11912
Source: C:\Windows\explorer.exe Code function: 5_2_0FC0A082 5_2_0FC0A082
Source: C:\Windows\explorer.exe Code function: 5_2_0FC13036 5_2_0FC13036
Source: C:\Windows\explorer.exe Code function: 5_2_11685232 5_2_11685232
Source: C:\Windows\explorer.exe Code function: 5_2_1167FB32 5_2_1167FB32
Source: C:\Windows\explorer.exe Code function: 5_2_1167FB30 5_2_1167FB30
Source: C:\Windows\explorer.exe Code function: 5_2_1167CD02 5_2_1167CD02
Source: C:\Windows\explorer.exe Code function: 5_2_11682912 5_2_11682912
Source: C:\Windows\explorer.exe Code function: 5_2_116885CD 5_2_116885CD
Source: C:\Windows\explorer.exe Code function: 5_2_11684036 5_2_11684036
Source: C:\Windows\explorer.exe Code function: 5_2_1167B082 5_2_1167B082
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062B634 7_2_0062B634
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05000535 7_2_05000535
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050C0591 7_2_050C0591
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050B2446 7_2_050B2446
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050AE4F6 7_2_050AE4F6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05024750 7_2_05024750
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05000770 7_2_05000770
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04FFC7C0 7_2_04FFC7C0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0501C6E0 7_2_0501C6E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0509A118 7_2_0509A118
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05088158 7_2_05088158
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050C01AA 7_2_050C01AA
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050B81CC 7_2_050B81CC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05092000 7_2_05092000
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04FF0100 7_2_04FF0100
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BA352 7_2_050BA352
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050C03E6 7_2_050C03E6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0500E3F0 7_2_0500E3F0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050A0274 7_2_050A0274
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050802C0 7_2_050802C0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0500AD00 7_2_0500AD00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04FF0CF2 7_2_04FF0CF2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0509CD1F 7_2_0509CD1F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05018DBF 7_2_05018DBF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05000C00 7_2_05000C00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04FFADE0 7_2_04FFADE0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050A0CB5 7_2_050A0CB5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05042F28 7_2_05042F28
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05020F30 7_2_05020F30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050A2F30 7_2_050A2F30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05074F40 7_2_05074F40
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0507EFA0 7_2_0507EFA0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BEE26 7_2_050BEE26
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04FF2FC8 7_2_04FF2FC8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05000E59 7_2_05000E59
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05012E90 7_2_05012E90
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BCE93 7_2_050BCE93
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BEEDB 7_2_050BEEDB
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04FE68B8 7_2_04FE68B8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05016962 7_2_05016962
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050029A0 7_2_050029A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050CA9A6 7_2_050CA9A6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0500A840 7_2_0500A840
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05002840 7_2_05002840
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0502E8F0 7_2_0502E8F0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BAB40 7_2_050BAB40
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04FFEA80 7_2_04FFEA80
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050B6BD7 7_2_050B6BD7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050B7571 7_2_050B7571
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04FF1460 7_2_04FF1460
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0509D5B0 7_2_0509D5B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BF43F 7_2_050BF43F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BF7B0 7_2_050BF7B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050B16CC 7_2_050B16CC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050CB16B 7_2_050CB16B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0503516C 7_2_0503516C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0500B1B0 7_2_0500B1B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04FEF172 7_2_04FEF172
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050070C0 7_2_050070C0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050AF0CC 7_2_050AF0CC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050B70E9 7_2_050B70E9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BF0E0 7_2_050BF0E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050B132D 7_2_050B132D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0504739A 7_2_0504739A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050052A0 7_2_050052A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04FED34C 7_2_04FED34C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0501B2C0 7_2_0501B2C0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050A12ED 7_2_050A12ED
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0501D2F0 7_2_0501D2F0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05003D40 7_2_05003D40
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050B1D5A 7_2_050B1D5A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050B7D73 7_2_050B7D73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0501FDC0 7_2_0501FDC0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05079C32 7_2_05079C32
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BFCF2 7_2_050BFCF2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BFF09 7_2_050BFF09
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05001F92 7_2_05001F92
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BFFB1 7_2_050BFFB1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05009EB0 7_2_05009EB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05095910 7_2_05095910
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05009950 7_2_05009950
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0501B950 7_2_0501B950
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0506D800 7_2_0506D800
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050038E0 7_2_050038E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BFB76 7_2_050BFB76
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0501FB80 7_2_0501FB80
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05075BF0 7_2_05075BF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0503DBF9 7_2_0503DBF9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050BFA49 7_2_050BFA49
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050B7A46 7_2_050B7A46
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05073A6C 7_2_05073A6C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_05045AA0 7_2_05045AA0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0509DAAC 7_2_0509DAAC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050A1AA3 7_2_050A1AA3
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_050ADAC6 7_2_050ADAC6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BE783 7_2_030BE783
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030A2FB0 7_2_030A2FB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030A9E4D 7_2_030A9E4D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030A9E50 7_2_030A9E50
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030A2D92 7_2_030A2D92
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030A2D90 7_2_030A2D90
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0137EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 01345130 appears 58 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0138F290 appears 103 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 012FB970 appears 262 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 01357E54 appears 107 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 05035130 appears 58 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 0507F290 appears 103 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 0062E951 appears 100 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 05047E54 appears 99 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 04FEB970 appears 257 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 0506EA12 appears 86 times
Sample file is different than original file name gathered from version info
Source: SOA.pdf.exe, 00000000.00000002.1688416945.000000000BAA0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SOA.pdf.exe
Source: SOA.pdf.exe, 00000000.00000002.1686871231.0000000009302000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs SOA.pdf.exe
Source: SOA.pdf.exe, 00000000.00000002.1686871231.0000000009302000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePowerShell.EXEj% vs SOA.pdf.exe
Source: SOA.pdf.exe, 00000000.00000002.1679867120.0000000004CCE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SOA.pdf.exe
Source: SOA.pdf.exe, 00000000.00000002.1676746506.00000000032F1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs SOA.pdf.exe
Source: SOA.pdf.exe, 00000000.00000002.1675767809.000000000154E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SOA.pdf.exe
Source: SOA.pdf.exe, 00000000.00000002.1683525864.0000000005D30000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs SOA.pdf.exe
Source: SOA.pdf.exe Binary or memory string: OriginalFilenamepnyp.exe< vs SOA.pdf.exe
Uses 32bit PE files
Source: SOA.pdf.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses a Windows Living Off The Land Binaries (LOL bins)
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe "C:\Windows\SysWOW64\cmstp.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe "C:\Windows\SysWOW64\cmstp.exe" Jump to behavior
Yara signature match
Source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.1737185931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.1737185931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.1737185931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.4113294260.0000000003370000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.4113294260.0000000003370000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.4113294260.0000000003370000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.4125730544.000000001169D000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
Source: 00000007.00000002.4113244559.0000000003340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.4113244559.0000000003340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.4113244559.0000000003340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.4112860100.00000000030A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.4112860100.00000000030A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.4112860100.00000000030A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.1679867120.00000000042F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.1679867120.00000000042F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.1679867120.00000000042F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: SOA.pdf.exe PID: 6576, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 7100, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: cmstp.exe PID: 7400, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: SOA.pdf.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, fIRJtYSmSVNuvBLOH1.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, rg4cNZ7Z6XJq22hny6.cs Security API names: _0020.SetAccessControl
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, rg4cNZ7Z6XJq22hny6.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, rg4cNZ7Z6XJq22hny6.cs Security API names: _0020.AddAccessRule
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, fIRJtYSmSVNuvBLOH1.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, rg4cNZ7Z6XJq22hny6.cs Security API names: _0020.SetAccessControl
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, rg4cNZ7Z6XJq22hny6.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, rg4cNZ7Z6XJq22hny6.cs Security API names: _0020.AddAccessRule
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, fIRJtYSmSVNuvBLOH1.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, rg4cNZ7Z6XJq22hny6.cs Security API names: _0020.SetAccessControl
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, rg4cNZ7Z6XJq22hny6.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, rg4cNZ7Z6XJq22hny6.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.evad.winEXE@12/6@11/3
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_00628F05 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,InitiateSystemShutdownW,AdjustTokenPrivileges,CloseHandle, 7_2_00628F05
Source: C:\Users\user\Desktop\SOA.pdf.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SOA.pdf.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6628:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7444:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b1bwsst4.ec3.ps1 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Command line argument: kernel32.dll 7_2_00626052
Source: SOA.pdf.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SOA.pdf.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SOA.pdf.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SOA.pdf.exe ReversingLabs: Detection: 47%
Source: cmstp.exe String found in binary or memory: /k certutil.exe -f -enterprise -v -addstore Root "%s"
Source: unknown Process created: C:\Users\user\Desktop\SOA.pdf.exe "C:\Users\user\Desktop\SOA.pdf.exe"
Source: C:\Users\user\Desktop\SOA.pdf.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA.pdf.exe"
Source: C:\Users\user\Desktop\SOA.pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe "C:\Windows\SysWOW64\cmstp.exe"
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SOA.pdf.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA.pdf.exe" Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe "C:\Windows\SysWOW64\cmstp.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: cmutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SOA.pdf.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SOA.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SOA.pdf.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: cmstp.pdbGCTL source: RegSvcs.exe, 00000003.00000002.1737979318.00000000010E0000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1737704482.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000002.4112710063.0000000000620000.00000040.80000000.00040000.00000000.sdmp
Source: Binary string: RegSvcs.pdb, source: explorer.exe, 00000005.00000002.4125384172.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, cmstp.exe, 00000007.00000002.4113368969.00000000033DB000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000002.4114729451.000000000550F000.00000004.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000003.00000002.1738117014.00000000012D0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000007.00000002.4113903566.000000000515E000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1740249791.0000000004E15000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000002.4113903566.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1737819708.0000000004C62000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000003.00000002.1738117014.00000000012D0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 00000007.00000002.4113903566.000000000515E000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1740249791.0000000004E15000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000002.4113903566.0000000004FC0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1737819708.0000000004C62000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: cmstp.pdb source: RegSvcs.exe, 00000003.00000002.1737979318.00000000010E0000.00000040.10000000.00040000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1737704482.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 00000007.00000002.4112710063.0000000000620000.00000040.80000000.00040000.00000000.sdmp
Source: Binary string: RegSvcs.pdb source: explorer.exe, 00000005.00000002.4125384172.0000000010E6F000.00000004.80000000.00040000.00000000.sdmp, cmstp.exe, 00000007.00000002.4113368969.00000000033DB000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000002.4114729451.000000000550F000.00000004.10000000.00040000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.SOA.pdf.exe.3317cb0.7.raw.unpack, HomeView.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, rg4cNZ7Z6XJq22hny6.cs .Net Code: P89GKllHJI System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, rg4cNZ7Z6XJq22hny6.cs .Net Code: P89GKllHJI System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA.pdf.exe.5d30000.10.raw.unpack, HomeView.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, rg4cNZ7Z6XJq22hny6.cs .Net Code: P89GKllHJI System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_0190CE98 pushad ; retf 0_2_0190CE99
Source: C:\Users\user\Desktop\SOA.pdf.exe Code function: 0_2_01903AD7 push ebx; retf 0_2_01903ADA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041A0C3 push ecx; ret 3_2_0041A0CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041D8E4 push dword ptr [2D1A0EF1h]; ret 3_2_0041E55C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004179C2 push ecx; retf 3_2_004179C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041D4F2 push eax; ret 3_2_0041D4F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041D4FB push eax; ret 3_2_0041D562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041D4A5 push eax; ret 3_2_0041D4F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041D55C push eax; ret 3_2_0041D562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041BD21 push es; iretd 3_2_0041BD2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00416622 push ebx; iretd 3_2_00416628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012D225F pushad ; ret 3_2_012D27F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012D27FA pushad ; ret 3_2_012D27F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013009AD push ecx; mov dword ptr [esp], ecx 3_2_013009B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012D283D push eax; iretd 3_2_012D2858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012D1368 push eax; iretd 3_2_012D1369
Source: C:\Windows\explorer.exe Code function: 5_2_0FC17B02 push esp; retn 0000h 5_2_0FC17B03
Source: C:\Windows\explorer.exe Code function: 5_2_0FC17B1E push esp; retn 0000h 5_2_0FC17B1F
Source: C:\Windows\explorer.exe Code function: 5_2_0FC179B5 push esp; retn 0000h 5_2_0FC17AE7
Source: C:\Windows\explorer.exe Code function: 5_2_11688B02 push esp; retn 0000h 5_2_11688B03
Source: C:\Windows\explorer.exe Code function: 5_2_11688B1E push esp; retn 0000h 5_2_11688B1F
Source: C:\Windows\explorer.exe Code function: 5_2_116889B5 push esp; retn 0000h 5_2_11688AE7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_00631A3D push ecx; ret 7_2_00631A50
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04FF09AD push ecx; mov dword ptr [esp], ecx 7_2_04FF09B6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BA0C3 push ecx; ret 7_2_030BA0CD
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030B6622 push ebx; iretd 7_2_030B6628
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BD55C push eax; ret 7_2_030BD562
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BD4A5 push eax; ret 7_2_030BD4F8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BD4FB push eax; ret 7_2_030BD562
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BE4FC push dword ptr [2D1A0EF1h]; ret 7_2_030BE55C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_030BD4F2 push eax; ret 7_2_030BD4F8
Source: SOA.pdf.exe Static PE information: section name: .text entropy: 7.979289084596183
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, xua1oYXUiXHnf2ml9D.cs High entropy of concatenated method names: 'Dispose', 'O0BjRPCRZm', 'lbCvaoNaxi', 'A99eeAFkOZ', 'bSDjnAgAj1', 'h4ejzUteHx', 'ProcessDialogKey', 'R1jvcm8KRr', 'srovjv8Pk2', 'a6EvvWwOFS'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, M7twTrwqQfkhIZEobB.cs High entropy of concatenated method names: 'ffNUSbTpQqbmntN8BSU', 'OYYa6HTvMI5Li8ifGXx', 'UsE5PyVZeH', 'osX53H7qS2', 'lwb5Do63nH', 'yG10yYTR9hbXe6jMe89', 'AnpJ41TWbaBjVFFRrWo'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, yr4HAwrbn7oK5XqWUy.cs High entropy of concatenated method names: 'bwBP1Ush5U', 'UySPalGj8C', 'Tl3PYsE5nQ', 'vIQPV4aUHe', 'penPXGpC5u', 'ct6PQ3hOQi', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, FMvLb3EQyqceO8Ryko.cs High entropy of concatenated method names: 'l26bmP5j3K', 'DsfbkH9s3Z', 'OJUbXihDHB', 'IrBbgkI6o5', 'k1hbampKSt', 'nPCbYR1uWh', 'WNrbVHtbls', 'OxIbQIp0LD', 'viAbEhaZlR', 'cbKbhGhJjl'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, dZGeosQQLQdONeD9rBa.cs High entropy of concatenated method names: 'ToString', 'SEeDWWYKBZ', 'qt3DGQMSH6', 'pRrDB051hi', 'GxwD75y4T4', 'dtgDdmmCym', 'APxD2pHX94', 'xZgDZx3Rui', 'z7rnCvFeVkRjvwqiN37', 'LgoQZsF2A5eMnUC4XwY'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, saliMw0RkTLNaxA21C.cs High entropy of concatenated method names: 'ol7NSH1M7C', 'ndONfpDyT8', 'ToString', 'NK4N79Vt6D', 'Jc8NdIaq42', 'gSjN2EUat7', 'GFaNZ8m8pS', 'XGRN53Vpis', 'iopNTBdg2r', 'f5BN0VEye9'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, r1UKV3Ir2MMiw9SYpt.cs High entropy of concatenated method names: 'jVr2HERFge', 'Mtj2J5Ytly', 'RxO2L8uOFC', 'IWr2pVNe3m', 'ofv2bFCZCZ', 'T912ItyrKn', 't9G2N4SmHr', 'Jaj2PFVTQJ', 'gRZ23PtQma', 'q492D5ofyw'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, ESxAufyR5ZNOToYQUu.cs High entropy of concatenated method names: 'Fk9jTT0mI9', 'E5Tj0sFWsK', 'fZnjS2yqiL', 'v25jfIgJmU', 'zyajbZMWBu', 'xpXjIcdTpp', 'CX033BXkn0VGSNulAW', 'JHYJImOFUh8gAsM70w', 'uqhjjU3lGW', 'iZLjWSii7d'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, Ktb5HDN6rwFe8dRBn4.cs High entropy of concatenated method names: 'evh3jyCox2', 'HWO3WjnL3C', 'y8g3Gr9Icw', 'Y1W37Pyf5c', 'WKU3dLkTi9', 'jwq3ZVWiUO', 'LFj3581DpA', 'uWZPAMuLwv', 'khdPUHwJGx', 'RQXPR480ni'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, lLXVljPSd58AwLL9LH.cs High entropy of concatenated method names: 'rHxNUNZO5G', 'mYdNnIW0Rw', 'kxBPc6QYbm', 'DA5Pj1HFrZ', 'IxjNoAObfC', 'v1sNkMA0Me', 'ANONCyX9L4', 'LrQNXB0hqP', 'aE6NgPrD3Q', 'DDUNrO4kVC'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, I2stbBTqfcmqJ1LZ8j.cs High entropy of concatenated method names: 'pUeZiyd5LE', 'C31Z8QdNUX', 'vnX2YGNACc', 'YcO2VOZyjY', 'idL2QC0Cef', 'EOr2EBIYHS', 'w852h0tR6y', 'B2O2xcxkko', 'K2l2u2txOS', 'nsM2mi74wl'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, gU0AJlQd0AhhiBTmQ9w.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zF7DXsa8Xd', 'ilGDgFkUwE', 'wcfDr7wjVw', 'jBKDtjfbwy', 'HdsD4f9rNB', 'gdwDw05jSo', 'jZpDA6I54l'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, BP697pq2xgbxjFUuP6.cs High entropy of concatenated method names: 'ToString', 'aMMIoCYpPv', 'WVIIadrmg0', 'MleIYah0sC', 'ck2IV2qyEY', 'c4UIQAuICO', 'q8SIEhgUmB', 'jNLIhUrloc', 'FodIxDPWM6', 'e7RIumCS2o'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, rg4cNZ7Z6XJq22hny6.cs High entropy of concatenated method names: 'u8PWBIrtkp', 'OlQW7Plq2l', 'A0oWdtnG23', 'QysW2ZjZvf', 'B4cWZ9y62F', 'FlSW5tSQUu', 'KmfWTKKQnu', 'yeIW00NoQ5', 'VOZWFM0oRl', 'tRpWS2JZ0J'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, NpYkvcRVxtGGhDPW02.cs High entropy of concatenated method names: 'yTa5BrT5Ka', 'DTn5dcClAW', 'd885ZMUfyd', 'FkK5T7sw7j', 'iGO507OEbl', 'l9DZ4MnKWW', 'mRHZwNHi44', 'O36ZAVT2q8', 'pbjZUIK0VL', 'UQeZRbRMhM'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, m00S5XuO4GwZill2X1.cs High entropy of concatenated method names: 'qE2yLP69oJ', 'bIMypxi3W4', 'ISBy1RAPmZ', 'iqyyaqd7Ki', 'xySyVN1556', 'OacyQ5FbAG', 'VoXyh8tYuE', 'HVtyxDrahY', 'HkfymEbvsD', 'PNIyoGlHh4'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, hlKH0ZF0W3gACJPmjH.cs High entropy of concatenated method names: 'UTvK6fi8n', 'IYYH0Z4nX', 'WOMJg3JtT', 'bup8omOR9', 'Xqlpj0iUp', 'xpsMK2Tic', 'xnfdu8txCRRnhBPoum', 'lb0X5vqH3AOpDer1SJ', 'hqxPa5RYa', 'cNFD7Vvpc'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, i8xIjeYUYfVl8TwJ7d.cs High entropy of concatenated method names: 'IyZP72qeFL', 'hRGPdjiY8t', 'jLFP2i7jvP', 'sQ7PZ0o4i4', 'mFmP5Nr53Z', 'cAqPTU6KHI', 'jTGP0WtEgA', 'zonPFeXyDU', 'Am5PSNauN6', 'soUPfGrH6a'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, fIRJtYSmSVNuvBLOH1.cs High entropy of concatenated method names: 'bJDdXxR9Y7', 'vFJdg6lwtp', 'MNkdrB9DXK', 'nH9dtxrC1h', 'lLFd4LoBJ4', 'nkIdwB8GYf', 'Mh4dArfc36', 'ySadUYXevD', 'PxydRtCBs5', 'u95dn5tL41'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, YNCbXTBtFiqUttiU21.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'tSAvRkZoUr', 'Bh6vnM3Vct', 'APvvzODLEQ', 'c9rWcDVKax', 'XuSWjM1IHc', 'rlGWvUglWb', 'hbJWWTcEIh', 'YDM7eJGMAlhluVLOEFi'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, OeEfduKhMOm8qyNypZ.cs High entropy of concatenated method names: 'iaUTO0DnGN', 'EtfT9wwTQo', 'ylFTKUuvA0', 'nj6THuIN21', 'sXfTiSSnLp', 'QIbTJSJwRM', 'QJ8T8VDYj9', 'xZDTL8PkZB', 'OVQTphaK78', 'HFZTMMP7Op'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, ER2kJUQVoDFp9V1Nlwb.cs High entropy of concatenated method names: 'SgD3OgV8gN', 'yM3392FRWv', 'swb3KpSLWP', 'APK3HMkUmO', 'nSP3iwWNdS', 'UdF3JNtWep', 'O5I38AqiGc', 'cuk3LZjpts', 'eD83p0v5tH', 'Kl43MXEG8i'
Source: 0.2.SOA.pdf.exe.baa0000.14.raw.unpack, xkO71waWoN1cm8No39.cs High entropy of concatenated method names: 'QYZT7VqkUe', 'tq6T2hNIrM', 'oduT5xZ0nc', 'iN55n5DHGK', 'wji5zKPugk', 'hZ6TcUwteD', 'R4JTjyf9at', 'camTvN8Ykb', 'tlrTWAaqoh', 'lYwTGXKoxv'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, xua1oYXUiXHnf2ml9D.cs High entropy of concatenated method names: 'Dispose', 'O0BjRPCRZm', 'lbCvaoNaxi', 'A99eeAFkOZ', 'bSDjnAgAj1', 'h4ejzUteHx', 'ProcessDialogKey', 'R1jvcm8KRr', 'srovjv8Pk2', 'a6EvvWwOFS'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, M7twTrwqQfkhIZEobB.cs High entropy of concatenated method names: 'ffNUSbTpQqbmntN8BSU', 'OYYa6HTvMI5Li8ifGXx', 'UsE5PyVZeH', 'osX53H7qS2', 'lwb5Do63nH', 'yG10yYTR9hbXe6jMe89', 'AnpJ41TWbaBjVFFRrWo'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, yr4HAwrbn7oK5XqWUy.cs High entropy of concatenated method names: 'bwBP1Ush5U', 'UySPalGj8C', 'Tl3PYsE5nQ', 'vIQPV4aUHe', 'penPXGpC5u', 'ct6PQ3hOQi', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, FMvLb3EQyqceO8Ryko.cs High entropy of concatenated method names: 'l26bmP5j3K', 'DsfbkH9s3Z', 'OJUbXihDHB', 'IrBbgkI6o5', 'k1hbampKSt', 'nPCbYR1uWh', 'WNrbVHtbls', 'OxIbQIp0LD', 'viAbEhaZlR', 'cbKbhGhJjl'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, dZGeosQQLQdONeD9rBa.cs High entropy of concatenated method names: 'ToString', 'SEeDWWYKBZ', 'qt3DGQMSH6', 'pRrDB051hi', 'GxwD75y4T4', 'dtgDdmmCym', 'APxD2pHX94', 'xZgDZx3Rui', 'z7rnCvFeVkRjvwqiN37', 'LgoQZsF2A5eMnUC4XwY'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, saliMw0RkTLNaxA21C.cs High entropy of concatenated method names: 'ol7NSH1M7C', 'ndONfpDyT8', 'ToString', 'NK4N79Vt6D', 'Jc8NdIaq42', 'gSjN2EUat7', 'GFaNZ8m8pS', 'XGRN53Vpis', 'iopNTBdg2r', 'f5BN0VEye9'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, r1UKV3Ir2MMiw9SYpt.cs High entropy of concatenated method names: 'jVr2HERFge', 'Mtj2J5Ytly', 'RxO2L8uOFC', 'IWr2pVNe3m', 'ofv2bFCZCZ', 'T912ItyrKn', 't9G2N4SmHr', 'Jaj2PFVTQJ', 'gRZ23PtQma', 'q492D5ofyw'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, ESxAufyR5ZNOToYQUu.cs High entropy of concatenated method names: 'Fk9jTT0mI9', 'E5Tj0sFWsK', 'fZnjS2yqiL', 'v25jfIgJmU', 'zyajbZMWBu', 'xpXjIcdTpp', 'CX033BXkn0VGSNulAW', 'JHYJImOFUh8gAsM70w', 'uqhjjU3lGW', 'iZLjWSii7d'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, Ktb5HDN6rwFe8dRBn4.cs High entropy of concatenated method names: 'evh3jyCox2', 'HWO3WjnL3C', 'y8g3Gr9Icw', 'Y1W37Pyf5c', 'WKU3dLkTi9', 'jwq3ZVWiUO', 'LFj3581DpA', 'uWZPAMuLwv', 'khdPUHwJGx', 'RQXPR480ni'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, lLXVljPSd58AwLL9LH.cs High entropy of concatenated method names: 'rHxNUNZO5G', 'mYdNnIW0Rw', 'kxBPc6QYbm', 'DA5Pj1HFrZ', 'IxjNoAObfC', 'v1sNkMA0Me', 'ANONCyX9L4', 'LrQNXB0hqP', 'aE6NgPrD3Q', 'DDUNrO4kVC'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, I2stbBTqfcmqJ1LZ8j.cs High entropy of concatenated method names: 'pUeZiyd5LE', 'C31Z8QdNUX', 'vnX2YGNACc', 'YcO2VOZyjY', 'idL2QC0Cef', 'EOr2EBIYHS', 'w852h0tR6y', 'B2O2xcxkko', 'K2l2u2txOS', 'nsM2mi74wl'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, gU0AJlQd0AhhiBTmQ9w.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zF7DXsa8Xd', 'ilGDgFkUwE', 'wcfDr7wjVw', 'jBKDtjfbwy', 'HdsD4f9rNB', 'gdwDw05jSo', 'jZpDA6I54l'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, BP697pq2xgbxjFUuP6.cs High entropy of concatenated method names: 'ToString', 'aMMIoCYpPv', 'WVIIadrmg0', 'MleIYah0sC', 'ck2IV2qyEY', 'c4UIQAuICO', 'q8SIEhgUmB', 'jNLIhUrloc', 'FodIxDPWM6', 'e7RIumCS2o'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, rg4cNZ7Z6XJq22hny6.cs High entropy of concatenated method names: 'u8PWBIrtkp', 'OlQW7Plq2l', 'A0oWdtnG23', 'QysW2ZjZvf', 'B4cWZ9y62F', 'FlSW5tSQUu', 'KmfWTKKQnu', 'yeIW00NoQ5', 'VOZWFM0oRl', 'tRpWS2JZ0J'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, NpYkvcRVxtGGhDPW02.cs High entropy of concatenated method names: 'yTa5BrT5Ka', 'DTn5dcClAW', 'd885ZMUfyd', 'FkK5T7sw7j', 'iGO507OEbl', 'l9DZ4MnKWW', 'mRHZwNHi44', 'O36ZAVT2q8', 'pbjZUIK0VL', 'UQeZRbRMhM'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, m00S5XuO4GwZill2X1.cs High entropy of concatenated method names: 'qE2yLP69oJ', 'bIMypxi3W4', 'ISBy1RAPmZ', 'iqyyaqd7Ki', 'xySyVN1556', 'OacyQ5FbAG', 'VoXyh8tYuE', 'HVtyxDrahY', 'HkfymEbvsD', 'PNIyoGlHh4'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, hlKH0ZF0W3gACJPmjH.cs High entropy of concatenated method names: 'UTvK6fi8n', 'IYYH0Z4nX', 'WOMJg3JtT', 'bup8omOR9', 'Xqlpj0iUp', 'xpsMK2Tic', 'xnfdu8txCRRnhBPoum', 'lb0X5vqH3AOpDer1SJ', 'hqxPa5RYa', 'cNFD7Vvpc'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, i8xIjeYUYfVl8TwJ7d.cs High entropy of concatenated method names: 'IyZP72qeFL', 'hRGPdjiY8t', 'jLFP2i7jvP', 'sQ7PZ0o4i4', 'mFmP5Nr53Z', 'cAqPTU6KHI', 'jTGP0WtEgA', 'zonPFeXyDU', 'Am5PSNauN6', 'soUPfGrH6a'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, fIRJtYSmSVNuvBLOH1.cs High entropy of concatenated method names: 'bJDdXxR9Y7', 'vFJdg6lwtp', 'MNkdrB9DXK', 'nH9dtxrC1h', 'lLFd4LoBJ4', 'nkIdwB8GYf', 'Mh4dArfc36', 'ySadUYXevD', 'PxydRtCBs5', 'u95dn5tL41'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, YNCbXTBtFiqUttiU21.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'tSAvRkZoUr', 'Bh6vnM3Vct', 'APvvzODLEQ', 'c9rWcDVKax', 'XuSWjM1IHc', 'rlGWvUglWb', 'hbJWWTcEIh', 'YDM7eJGMAlhluVLOEFi'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, OeEfduKhMOm8qyNypZ.cs High entropy of concatenated method names: 'iaUTO0DnGN', 'EtfT9wwTQo', 'ylFTKUuvA0', 'nj6THuIN21', 'sXfTiSSnLp', 'QIbTJSJwRM', 'QJ8T8VDYj9', 'xZDTL8PkZB', 'OVQTphaK78', 'HFZTMMP7Op'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, ER2kJUQVoDFp9V1Nlwb.cs High entropy of concatenated method names: 'SgD3OgV8gN', 'yM3392FRWv', 'swb3KpSLWP', 'APK3HMkUmO', 'nSP3iwWNdS', 'UdF3JNtWep', 'O5I38AqiGc', 'cuk3LZjpts', 'eD83p0v5tH', 'Kl43MXEG8i'
Source: 0.2.SOA.pdf.exe.4e9fe00.8.raw.unpack, xkO71waWoN1cm8No39.cs High entropy of concatenated method names: 'QYZT7VqkUe', 'tq6T2hNIrM', 'oduT5xZ0nc', 'iN55n5DHGK', 'wji5zKPugk', 'hZ6TcUwteD', 'R4JTjyf9at', 'camTvN8Ykb', 'tlrTWAaqoh', 'lYwTGXKoxv'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, xua1oYXUiXHnf2ml9D.cs High entropy of concatenated method names: 'Dispose', 'O0BjRPCRZm', 'lbCvaoNaxi', 'A99eeAFkOZ', 'bSDjnAgAj1', 'h4ejzUteHx', 'ProcessDialogKey', 'R1jvcm8KRr', 'srovjv8Pk2', 'a6EvvWwOFS'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, M7twTrwqQfkhIZEobB.cs High entropy of concatenated method names: 'ffNUSbTpQqbmntN8BSU', 'OYYa6HTvMI5Li8ifGXx', 'UsE5PyVZeH', 'osX53H7qS2', 'lwb5Do63nH', 'yG10yYTR9hbXe6jMe89', 'AnpJ41TWbaBjVFFRrWo'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, yr4HAwrbn7oK5XqWUy.cs High entropy of concatenated method names: 'bwBP1Ush5U', 'UySPalGj8C', 'Tl3PYsE5nQ', 'vIQPV4aUHe', 'penPXGpC5u', 'ct6PQ3hOQi', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, FMvLb3EQyqceO8Ryko.cs High entropy of concatenated method names: 'l26bmP5j3K', 'DsfbkH9s3Z', 'OJUbXihDHB', 'IrBbgkI6o5', 'k1hbampKSt', 'nPCbYR1uWh', 'WNrbVHtbls', 'OxIbQIp0LD', 'viAbEhaZlR', 'cbKbhGhJjl'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, dZGeosQQLQdONeD9rBa.cs High entropy of concatenated method names: 'ToString', 'SEeDWWYKBZ', 'qt3DGQMSH6', 'pRrDB051hi', 'GxwD75y4T4', 'dtgDdmmCym', 'APxD2pHX94', 'xZgDZx3Rui', 'z7rnCvFeVkRjvwqiN37', 'LgoQZsF2A5eMnUC4XwY'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, saliMw0RkTLNaxA21C.cs High entropy of concatenated method names: 'ol7NSH1M7C', 'ndONfpDyT8', 'ToString', 'NK4N79Vt6D', 'Jc8NdIaq42', 'gSjN2EUat7', 'GFaNZ8m8pS', 'XGRN53Vpis', 'iopNTBdg2r', 'f5BN0VEye9'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, r1UKV3Ir2MMiw9SYpt.cs High entropy of concatenated method names: 'jVr2HERFge', 'Mtj2J5Ytly', 'RxO2L8uOFC', 'IWr2pVNe3m', 'ofv2bFCZCZ', 'T912ItyrKn', 't9G2N4SmHr', 'Jaj2PFVTQJ', 'gRZ23PtQma', 'q492D5ofyw'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, ESxAufyR5ZNOToYQUu.cs High entropy of concatenated method names: 'Fk9jTT0mI9', 'E5Tj0sFWsK', 'fZnjS2yqiL', 'v25jfIgJmU', 'zyajbZMWBu', 'xpXjIcdTpp', 'CX033BXkn0VGSNulAW', 'JHYJImOFUh8gAsM70w', 'uqhjjU3lGW', 'iZLjWSii7d'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, Ktb5HDN6rwFe8dRBn4.cs High entropy of concatenated method names: 'evh3jyCox2', 'HWO3WjnL3C', 'y8g3Gr9Icw', 'Y1W37Pyf5c', 'WKU3dLkTi9', 'jwq3ZVWiUO', 'LFj3581DpA', 'uWZPAMuLwv', 'khdPUHwJGx', 'RQXPR480ni'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, lLXVljPSd58AwLL9LH.cs High entropy of concatenated method names: 'rHxNUNZO5G', 'mYdNnIW0Rw', 'kxBPc6QYbm', 'DA5Pj1HFrZ', 'IxjNoAObfC', 'v1sNkMA0Me', 'ANONCyX9L4', 'LrQNXB0hqP', 'aE6NgPrD3Q', 'DDUNrO4kVC'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, I2stbBTqfcmqJ1LZ8j.cs High entropy of concatenated method names: 'pUeZiyd5LE', 'C31Z8QdNUX', 'vnX2YGNACc', 'YcO2VOZyjY', 'idL2QC0Cef', 'EOr2EBIYHS', 'w852h0tR6y', 'B2O2xcxkko', 'K2l2u2txOS', 'nsM2mi74wl'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, gU0AJlQd0AhhiBTmQ9w.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zF7DXsa8Xd', 'ilGDgFkUwE', 'wcfDr7wjVw', 'jBKDtjfbwy', 'HdsD4f9rNB', 'gdwDw05jSo', 'jZpDA6I54l'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, BP697pq2xgbxjFUuP6.cs High entropy of concatenated method names: 'ToString', 'aMMIoCYpPv', 'WVIIadrmg0', 'MleIYah0sC', 'ck2IV2qyEY', 'c4UIQAuICO', 'q8SIEhgUmB', 'jNLIhUrloc', 'FodIxDPWM6', 'e7RIumCS2o'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, rg4cNZ7Z6XJq22hny6.cs High entropy of concatenated method names: 'u8PWBIrtkp', 'OlQW7Plq2l', 'A0oWdtnG23', 'QysW2ZjZvf', 'B4cWZ9y62F', 'FlSW5tSQUu', 'KmfWTKKQnu', 'yeIW00NoQ5', 'VOZWFM0oRl', 'tRpWS2JZ0J'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, NpYkvcRVxtGGhDPW02.cs High entropy of concatenated method names: 'yTa5BrT5Ka', 'DTn5dcClAW', 'd885ZMUfyd', 'FkK5T7sw7j', 'iGO507OEbl', 'l9DZ4MnKWW', 'mRHZwNHi44', 'O36ZAVT2q8', 'pbjZUIK0VL', 'UQeZRbRMhM'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, m00S5XuO4GwZill2X1.cs High entropy of concatenated method names: 'qE2yLP69oJ', 'bIMypxi3W4', 'ISBy1RAPmZ', 'iqyyaqd7Ki', 'xySyVN1556', 'OacyQ5FbAG', 'VoXyh8tYuE', 'HVtyxDrahY', 'HkfymEbvsD', 'PNIyoGlHh4'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, hlKH0ZF0W3gACJPmjH.cs High entropy of concatenated method names: 'UTvK6fi8n', 'IYYH0Z4nX', 'WOMJg3JtT', 'bup8omOR9', 'Xqlpj0iUp', 'xpsMK2Tic', 'xnfdu8txCRRnhBPoum', 'lb0X5vqH3AOpDer1SJ', 'hqxPa5RYa', 'cNFD7Vvpc'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, i8xIjeYUYfVl8TwJ7d.cs High entropy of concatenated method names: 'IyZP72qeFL', 'hRGPdjiY8t', 'jLFP2i7jvP', 'sQ7PZ0o4i4', 'mFmP5Nr53Z', 'cAqPTU6KHI', 'jTGP0WtEgA', 'zonPFeXyDU', 'Am5PSNauN6', 'soUPfGrH6a'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, fIRJtYSmSVNuvBLOH1.cs High entropy of concatenated method names: 'bJDdXxR9Y7', 'vFJdg6lwtp', 'MNkdrB9DXK', 'nH9dtxrC1h', 'lLFd4LoBJ4', 'nkIdwB8GYf', 'Mh4dArfc36', 'ySadUYXevD', 'PxydRtCBs5', 'u95dn5tL41'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, YNCbXTBtFiqUttiU21.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'tSAvRkZoUr', 'Bh6vnM3Vct', 'APvvzODLEQ', 'c9rWcDVKax', 'XuSWjM1IHc', 'rlGWvUglWb', 'hbJWWTcEIh', 'YDM7eJGMAlhluVLOEFi'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, OeEfduKhMOm8qyNypZ.cs High entropy of concatenated method names: 'iaUTO0DnGN', 'EtfT9wwTQo', 'ylFTKUuvA0', 'nj6THuIN21', 'sXfTiSSnLp', 'QIbTJSJwRM', 'QJ8T8VDYj9', 'xZDTL8PkZB', 'OVQTphaK78', 'HFZTMMP7Op'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, ER2kJUQVoDFp9V1Nlwb.cs High entropy of concatenated method names: 'SgD3OgV8gN', 'yM3392FRWv', 'swb3KpSLWP', 'APK3HMkUmO', 'nSP3iwWNdS', 'UdF3JNtWep', 'O5I38AqiGc', 'cuk3LZjpts', 'eD83p0v5tH', 'Kl43MXEG8i'
Source: 0.2.SOA.pdf.exe.4f0fa20.9.raw.unpack, xkO71waWoN1cm8No39.cs High entropy of concatenated method names: 'QYZT7VqkUe', 'tq6T2hNIrM', 'oduT5xZ0nc', 'iN55n5DHGK', 'wji5zKPugk', 'hZ6TcUwteD', 'R4JTjyf9at', 'camTvN8Ykb', 'tlrTWAaqoh', 'lYwTGXKoxv'
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062A068 memset,memset,RegOpenKeyExW,RegQueryValueExW,lstrcmpiW,LoadStringW,MessageBoxW,RegCloseKey,GetPrivateProfileIntW,GetPrivateProfileIntW,LoadStringW,LoadStringW,LoadStringW,MessageBoxW,GetSystemDirectoryW, 7_2_0062A068
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062A47F RegOpenKeyExW,RegQueryValueExW,GetPrivateProfileIntW,RegQueryValueExW,RegQueryValueExW,RegCloseKey, 7_2_0062A47F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062D233 RegOpenKeyExW,GetPrivateProfileIntW,GetSystemDirectoryW,memset,GetPrivateProfileStringW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,memset,RegEnumValueW,RegCloseKey, 7_2_0062D233
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062B634 LoadStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileIntW,LoadStringW,MessageBoxW,CmFree,CmFree,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,LoadStringW,MessageBoxW,memset,memset,memset,RegOpenKeyExW,RegQueryValueExW,ExpandEnvironmentStringsW,lstrcmpiW,LoadStringW,MessageBoxW,RegCloseKey,LoadStringW,RegCreateKeyW,lstrlenW,RegSetValueExW,LoadStringW,MessageBoxW,RegCloseKey,RegCloseKey,memset,memset,CopyFileW,LoadStringW,MessageBoxW,GetOSVersion,GetOSMajorVersion,CmMalloc,memset,CmFree,CmMalloc,memset,GetLastError,CmFree,lstrlenW,CmMalloc,lstrlenW,CmFree,CmFree,RegOpenKeyExW,RegDeleteValueW,RegCloseKey,LoadStringW,MessageBoxExW,CmMalloc,memset,CmFree,CmMalloc, 7_2_0062B634
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062DD1E memset,memset,memset,memset,LoadStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,RegCreateKeyExW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,RegCloseKey,lstrlenW,memset,lstrlenW,lstrlenW,RegSetValueExW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,CmMalloc,CreateFileW,CloseHandle,CmFree,CmFree,GetPrivateProfileIntW,SetFileAttributesW,SHFileOperationW,RegCloseKey,RegCloseKey, 7_2_0062DD1E
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062A6EE GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,LoadStringW,LoadStringW,lstrlenW,lstrlenW,lstrlenW,LoadStringW,LoadStringW,MessageBoxW,LoadStringW,GetSystemDirectoryW,LoadStringW,MessageBoxW, 7_2_0062A6EE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_00625DEC memset,GetPrivateProfileStringW,GetModuleHandleA,GetProcAddress,GetCurrentProcess,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetProcAddress,GetProcAddress,FreeLibrary, 7_2_00625DEC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062CAB4 GetSystemDirectoryW,memset,GetPrivateProfileStringW,RegOpenKeyExW,RegDeleteValueW,RegDeleteValueW,RegCloseKey,CmFree, 7_2_0062CAB4

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: pdf.exe Static PE information: SOA.pdf.exe
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: SOA.pdf.exe PID: 6576, type: MEMORYSTR
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe RDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe RDTSC instruction interceptor: First address: 409B6E second address: 409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe RDTSC instruction interceptor: First address: 30A9904 second address: 30A990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe RDTSC instruction interceptor: First address: 30A9B6E second address: 30A9B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory allocated: 18A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory allocated: 32F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory allocated: 3110000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory allocated: 9520000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory allocated: 7B40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory allocated: A520000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory allocated: B520000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory allocated: BB10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory allocated: 9520000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00409AA0 rdtsc 3_2_00409AA0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SOA.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6665 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3052 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 1682 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 8266 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 875 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 874 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Window / User API: threadDelayed 9723 Jump to behavior
Found decision node followed by non-executed suspicious APIs
Source: C:\Windows\explorer.exe Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe API coverage: 1.7 %
Source: C:\Windows\SysWOW64\cmstp.exe API coverage: 1.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SOA.pdf.exe TID: 6720 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7264 Thread sleep time: -8301034833169293s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 7724 Thread sleep count: 1682 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7724 Thread sleep time: -3364000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 7724 Thread sleep count: 8266 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7724 Thread sleep time: -16532000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 7488 Thread sleep count: 248 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 7488 Thread sleep time: -496000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 7488 Thread sleep count: 9723 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 7488 Thread sleep time: -19446000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\cmstp.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmstp.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062894B memset,memset,memset,SHGetFolderPathW,memset,SHGetFolderPathW,CmFree,memset,FindFirstFileW,GetLastError,memset,memset,FindNextFileW,FindClose, 7_2_0062894B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062B3C4 memset,GetPrivateProfileStringW,FindFirstFileW,memset,FindNextFileW, 7_2_0062B3C4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062F80E GetSystemInfo,GetVersionExW, 7_2_0062F80E
Source: C:\Users\user\Desktop\SOA.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000005.00000002.4120441914.00000000098A8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000005.00000002.4119592234.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000005.00000002.4119592234.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000005.00000002.4120441914.00000000098A8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000005.00000002.4116436541.00000000079FB000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: explorer.exe, 00000005.00000002.4113123360.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000005.00000002.4116436541.00000000079FB000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.1693271732.0000000009977000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000005.00000002.4116436541.00000000078AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000005.00000002.4119592234.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: explorer.exe, 00000005.00000000.1690318744.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4119592234.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3111535640.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4119592234.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1690318744.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3111535640.00000000097D4000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.1693271732.0000000009977000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: SOA.pdf.exe, 00000000.00000002.1675828884.0000000001582000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\|
Source: explorer.exe, 00000005.00000000.1684145492.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4116436541.0000000007A34000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000005.00000002.4113123360.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000005.00000002.4119479943.0000000009660000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000005.00000002.4113123360.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00409AA0 rdtsc 3_2_00409AA0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040ACE0 LdrLoadDll, 3_2_0040ACE0
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01330124 mov eax, dword ptr fs:[00000030h] 3_2_01330124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AA118 mov ecx, dword ptr fs:[00000030h] 3_2_013AA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AA118 mov eax, dword ptr fs:[00000030h] 3_2_013AA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AA118 mov eax, dword ptr fs:[00000030h] 3_2_013AA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AA118 mov eax, dword ptr fs:[00000030h] 3_2_013AA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C0115 mov eax, dword ptr fs:[00000030h] 3_2_013C0115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE10E mov eax, dword ptr fs:[00000030h] 3_2_013AE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE10E mov ecx, dword ptr fs:[00000030h] 3_2_013AE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE10E mov eax, dword ptr fs:[00000030h] 3_2_013AE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE10E mov eax, dword ptr fs:[00000030h] 3_2_013AE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE10E mov ecx, dword ptr fs:[00000030h] 3_2_013AE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE10E mov eax, dword ptr fs:[00000030h] 3_2_013AE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE10E mov eax, dword ptr fs:[00000030h] 3_2_013AE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE10E mov ecx, dword ptr fs:[00000030h] 3_2_013AE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE10E mov eax, dword ptr fs:[00000030h] 3_2_013AE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE10E mov ecx, dword ptr fs:[00000030h] 3_2_013AE10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D4164 mov eax, dword ptr fs:[00000030h] 3_2_013D4164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D4164 mov eax, dword ptr fs:[00000030h] 3_2_013D4164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01398158 mov eax, dword ptr fs:[00000030h] 3_2_01398158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01306154 mov eax, dword ptr fs:[00000030h] 3_2_01306154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01306154 mov eax, dword ptr fs:[00000030h] 3_2_01306154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FC156 mov eax, dword ptr fs:[00000030h] 3_2_012FC156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01394144 mov eax, dword ptr fs:[00000030h] 3_2_01394144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01394144 mov eax, dword ptr fs:[00000030h] 3_2_01394144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01394144 mov ecx, dword ptr fs:[00000030h] 3_2_01394144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01394144 mov eax, dword ptr fs:[00000030h] 3_2_01394144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01394144 mov eax, dword ptr fs:[00000030h] 3_2_01394144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138019F mov eax, dword ptr fs:[00000030h] 3_2_0138019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138019F mov eax, dword ptr fs:[00000030h] 3_2_0138019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138019F mov eax, dword ptr fs:[00000030h] 3_2_0138019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138019F mov eax, dword ptr fs:[00000030h] 3_2_0138019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01340185 mov eax, dword ptr fs:[00000030h] 3_2_01340185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013BC188 mov eax, dword ptr fs:[00000030h] 3_2_013BC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013BC188 mov eax, dword ptr fs:[00000030h] 3_2_013BC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FA197 mov eax, dword ptr fs:[00000030h] 3_2_012FA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FA197 mov eax, dword ptr fs:[00000030h] 3_2_012FA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FA197 mov eax, dword ptr fs:[00000030h] 3_2_012FA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A4180 mov eax, dword ptr fs:[00000030h] 3_2_013A4180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A4180 mov eax, dword ptr fs:[00000030h] 3_2_013A4180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013301F8 mov eax, dword ptr fs:[00000030h] 3_2_013301F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D61E5 mov eax, dword ptr fs:[00000030h] 3_2_013D61E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137E1D0 mov eax, dword ptr fs:[00000030h] 3_2_0137E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137E1D0 mov eax, dword ptr fs:[00000030h] 3_2_0137E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137E1D0 mov ecx, dword ptr fs:[00000030h] 3_2_0137E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137E1D0 mov eax, dword ptr fs:[00000030h] 3_2_0137E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137E1D0 mov eax, dword ptr fs:[00000030h] 3_2_0137E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C61C3 mov eax, dword ptr fs:[00000030h] 3_2_013C61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C61C3 mov eax, dword ptr fs:[00000030h] 3_2_013C61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01396030 mov eax, dword ptr fs:[00000030h] 3_2_01396030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FA020 mov eax, dword ptr fs:[00000030h] 3_2_012FA020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FC020 mov eax, dword ptr fs:[00000030h] 3_2_012FC020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131E016 mov eax, dword ptr fs:[00000030h] 3_2_0131E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131E016 mov eax, dword ptr fs:[00000030h] 3_2_0131E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131E016 mov eax, dword ptr fs:[00000030h] 3_2_0131E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131E016 mov eax, dword ptr fs:[00000030h] 3_2_0131E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01384000 mov ecx, dword ptr fs:[00000030h] 3_2_01384000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A2000 mov eax, dword ptr fs:[00000030h] 3_2_013A2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A2000 mov eax, dword ptr fs:[00000030h] 3_2_013A2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A2000 mov eax, dword ptr fs:[00000030h] 3_2_013A2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A2000 mov eax, dword ptr fs:[00000030h] 3_2_013A2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A2000 mov eax, dword ptr fs:[00000030h] 3_2_013A2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A2000 mov eax, dword ptr fs:[00000030h] 3_2_013A2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A2000 mov eax, dword ptr fs:[00000030h] 3_2_013A2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A2000 mov eax, dword ptr fs:[00000030h] 3_2_013A2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132C073 mov eax, dword ptr fs:[00000030h] 3_2_0132C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01302050 mov eax, dword ptr fs:[00000030h] 3_2_01302050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01386050 mov eax, dword ptr fs:[00000030h] 3_2_01386050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C60B8 mov eax, dword ptr fs:[00000030h] 3_2_013C60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C60B8 mov ecx, dword ptr fs:[00000030h] 3_2_013C60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012F80A0 mov eax, dword ptr fs:[00000030h] 3_2_012F80A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013980A8 mov eax, dword ptr fs:[00000030h] 3_2_013980A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130208A mov eax, dword ptr fs:[00000030h] 3_2_0130208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013420F0 mov ecx, dword ptr fs:[00000030h] 3_2_013420F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FA0E3 mov ecx, dword ptr fs:[00000030h] 3_2_012FA0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013860E0 mov eax, dword ptr fs:[00000030h] 3_2_013860E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013080E9 mov eax, dword ptr fs:[00000030h] 3_2_013080E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FC0F0 mov eax, dword ptr fs:[00000030h] 3_2_012FC0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013820DE mov eax, dword ptr fs:[00000030h] 3_2_013820DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D8324 mov eax, dword ptr fs:[00000030h] 3_2_013D8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D8324 mov ecx, dword ptr fs:[00000030h] 3_2_013D8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D8324 mov eax, dword ptr fs:[00000030h] 3_2_013D8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D8324 mov eax, dword ptr fs:[00000030h] 3_2_013D8324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01320310 mov ecx, dword ptr fs:[00000030h] 3_2_01320310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133A30B mov eax, dword ptr fs:[00000030h] 3_2_0133A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133A30B mov eax, dword ptr fs:[00000030h] 3_2_0133A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133A30B mov eax, dword ptr fs:[00000030h] 3_2_0133A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FC310 mov ecx, dword ptr fs:[00000030h] 3_2_012FC310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A437C mov eax, dword ptr fs:[00000030h] 3_2_013A437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138035C mov eax, dword ptr fs:[00000030h] 3_2_0138035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138035C mov eax, dword ptr fs:[00000030h] 3_2_0138035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138035C mov eax, dword ptr fs:[00000030h] 3_2_0138035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138035C mov ecx, dword ptr fs:[00000030h] 3_2_0138035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138035C mov eax, dword ptr fs:[00000030h] 3_2_0138035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138035C mov eax, dword ptr fs:[00000030h] 3_2_0138035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A8350 mov ecx, dword ptr fs:[00000030h] 3_2_013A8350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CA352 mov eax, dword ptr fs:[00000030h] 3_2_013CA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01382349 mov eax, dword ptr fs:[00000030h] 3_2_01382349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D634F mov eax, dword ptr fs:[00000030h] 3_2_013D634F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FE388 mov eax, dword ptr fs:[00000030h] 3_2_012FE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FE388 mov eax, dword ptr fs:[00000030h] 3_2_012FE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FE388 mov eax, dword ptr fs:[00000030h] 3_2_012FE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012F8397 mov eax, dword ptr fs:[00000030h] 3_2_012F8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012F8397 mov eax, dword ptr fs:[00000030h] 3_2_012F8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012F8397 mov eax, dword ptr fs:[00000030h] 3_2_012F8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132438F mov eax, dword ptr fs:[00000030h] 3_2_0132438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132438F mov eax, dword ptr fs:[00000030h] 3_2_0132438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131E3F0 mov eax, dword ptr fs:[00000030h] 3_2_0131E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131E3F0 mov eax, dword ptr fs:[00000030h] 3_2_0131E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131E3F0 mov eax, dword ptr fs:[00000030h] 3_2_0131E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013363FF mov eax, dword ptr fs:[00000030h] 3_2_013363FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013103E9 mov eax, dword ptr fs:[00000030h] 3_2_013103E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013103E9 mov eax, dword ptr fs:[00000030h] 3_2_013103E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013103E9 mov eax, dword ptr fs:[00000030h] 3_2_013103E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013103E9 mov eax, dword ptr fs:[00000030h] 3_2_013103E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013103E9 mov eax, dword ptr fs:[00000030h] 3_2_013103E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013103E9 mov eax, dword ptr fs:[00000030h] 3_2_013103E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013103E9 mov eax, dword ptr fs:[00000030h] 3_2_013103E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013103E9 mov eax, dword ptr fs:[00000030h] 3_2_013103E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE3DB mov eax, dword ptr fs:[00000030h] 3_2_013AE3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE3DB mov eax, dword ptr fs:[00000030h] 3_2_013AE3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE3DB mov ecx, dword ptr fs:[00000030h] 3_2_013AE3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AE3DB mov eax, dword ptr fs:[00000030h] 3_2_013AE3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A43D4 mov eax, dword ptr fs:[00000030h] 3_2_013A43D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A43D4 mov eax, dword ptr fs:[00000030h] 3_2_013A43D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0130A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0130A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0130A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0130A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0130A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0130A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013083C0 mov eax, dword ptr fs:[00000030h] 3_2_013083C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013083C0 mov eax, dword ptr fs:[00000030h] 3_2_013083C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013083C0 mov eax, dword ptr fs:[00000030h] 3_2_013083C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013083C0 mov eax, dword ptr fs:[00000030h] 3_2_013083C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013BC3CD mov eax, dword ptr fs:[00000030h] 3_2_013BC3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013863C0 mov eax, dword ptr fs:[00000030h] 3_2_013863C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012F823B mov eax, dword ptr fs:[00000030h] 3_2_012F823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012F826B mov eax, dword ptr fs:[00000030h] 3_2_012F826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 mov eax, dword ptr fs:[00000030h] 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 mov eax, dword ptr fs:[00000030h] 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 mov eax, dword ptr fs:[00000030h] 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 mov eax, dword ptr fs:[00000030h] 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 mov eax, dword ptr fs:[00000030h] 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 mov eax, dword ptr fs:[00000030h] 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 mov eax, dword ptr fs:[00000030h] 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 mov eax, dword ptr fs:[00000030h] 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 mov eax, dword ptr fs:[00000030h] 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 mov eax, dword ptr fs:[00000030h] 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 mov eax, dword ptr fs:[00000030h] 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B0274 mov eax, dword ptr fs:[00000030h] 3_2_013B0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01304260 mov eax, dword ptr fs:[00000030h] 3_2_01304260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01304260 mov eax, dword ptr fs:[00000030h] 3_2_01304260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01304260 mov eax, dword ptr fs:[00000030h] 3_2_01304260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D625D mov eax, dword ptr fs:[00000030h] 3_2_013D625D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01306259 mov eax, dword ptr fs:[00000030h] 3_2_01306259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013BA250 mov eax, dword ptr fs:[00000030h] 3_2_013BA250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013BA250 mov eax, dword ptr fs:[00000030h] 3_2_013BA250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01388243 mov eax, dword ptr fs:[00000030h] 3_2_01388243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01388243 mov ecx, dword ptr fs:[00000030h] 3_2_01388243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FA250 mov eax, dword ptr fs:[00000030h] 3_2_012FA250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013102A0 mov eax, dword ptr fs:[00000030h] 3_2_013102A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013102A0 mov eax, dword ptr fs:[00000030h] 3_2_013102A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013962A0 mov eax, dword ptr fs:[00000030h] 3_2_013962A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013962A0 mov ecx, dword ptr fs:[00000030h] 3_2_013962A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013962A0 mov eax, dword ptr fs:[00000030h] 3_2_013962A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013962A0 mov eax, dword ptr fs:[00000030h] 3_2_013962A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013962A0 mov eax, dword ptr fs:[00000030h] 3_2_013962A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013962A0 mov eax, dword ptr fs:[00000030h] 3_2_013962A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E284 mov eax, dword ptr fs:[00000030h] 3_2_0133E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E284 mov eax, dword ptr fs:[00000030h] 3_2_0133E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01380283 mov eax, dword ptr fs:[00000030h] 3_2_01380283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01380283 mov eax, dword ptr fs:[00000030h] 3_2_01380283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01380283 mov eax, dword ptr fs:[00000030h] 3_2_01380283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013102E1 mov eax, dword ptr fs:[00000030h] 3_2_013102E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013102E1 mov eax, dword ptr fs:[00000030h] 3_2_013102E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013102E1 mov eax, dword ptr fs:[00000030h] 3_2_013102E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D62D6 mov eax, dword ptr fs:[00000030h] 3_2_013D62D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0130A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0130A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0130A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0130A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0130A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310535 mov eax, dword ptr fs:[00000030h] 3_2_01310535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310535 mov eax, dword ptr fs:[00000030h] 3_2_01310535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310535 mov eax, dword ptr fs:[00000030h] 3_2_01310535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310535 mov eax, dword ptr fs:[00000030h] 3_2_01310535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310535 mov eax, dword ptr fs:[00000030h] 3_2_01310535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310535 mov eax, dword ptr fs:[00000030h] 3_2_01310535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E53E mov eax, dword ptr fs:[00000030h] 3_2_0132E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E53E mov eax, dword ptr fs:[00000030h] 3_2_0132E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E53E mov eax, dword ptr fs:[00000030h] 3_2_0132E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E53E mov eax, dword ptr fs:[00000030h] 3_2_0132E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E53E mov eax, dword ptr fs:[00000030h] 3_2_0132E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01396500 mov eax, dword ptr fs:[00000030h] 3_2_01396500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D4500 mov eax, dword ptr fs:[00000030h] 3_2_013D4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D4500 mov eax, dword ptr fs:[00000030h] 3_2_013D4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D4500 mov eax, dword ptr fs:[00000030h] 3_2_013D4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D4500 mov eax, dword ptr fs:[00000030h] 3_2_013D4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D4500 mov eax, dword ptr fs:[00000030h] 3_2_013D4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D4500 mov eax, dword ptr fs:[00000030h] 3_2_013D4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D4500 mov eax, dword ptr fs:[00000030h] 3_2_013D4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133656A mov eax, dword ptr fs:[00000030h] 3_2_0133656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133656A mov eax, dword ptr fs:[00000030h] 3_2_0133656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133656A mov eax, dword ptr fs:[00000030h] 3_2_0133656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01308550 mov eax, dword ptr fs:[00000030h] 3_2_01308550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01308550 mov eax, dword ptr fs:[00000030h] 3_2_01308550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013245B1 mov eax, dword ptr fs:[00000030h] 3_2_013245B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013245B1 mov eax, dword ptr fs:[00000030h] 3_2_013245B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013805A7 mov eax, dword ptr fs:[00000030h] 3_2_013805A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013805A7 mov eax, dword ptr fs:[00000030h] 3_2_013805A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013805A7 mov eax, dword ptr fs:[00000030h] 3_2_013805A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E59C mov eax, dword ptr fs:[00000030h] 3_2_0133E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01302582 mov eax, dword ptr fs:[00000030h] 3_2_01302582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01302582 mov ecx, dword ptr fs:[00000030h] 3_2_01302582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01334588 mov eax, dword ptr fs:[00000030h] 3_2_01334588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013025E0 mov eax, dword ptr fs:[00000030h] 3_2_013025E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0132E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0132E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0132E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0132E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0132E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0132E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0132E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0132E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133C5ED mov eax, dword ptr fs:[00000030h] 3_2_0133C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133C5ED mov eax, dword ptr fs:[00000030h] 3_2_0133C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013065D0 mov eax, dword ptr fs:[00000030h] 3_2_013065D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133A5D0 mov eax, dword ptr fs:[00000030h] 3_2_0133A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133A5D0 mov eax, dword ptr fs:[00000030h] 3_2_0133A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E5CF mov eax, dword ptr fs:[00000030h] 3_2_0133E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E5CF mov eax, dword ptr fs:[00000030h] 3_2_0133E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FC427 mov eax, dword ptr fs:[00000030h] 3_2_012FC427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FE420 mov eax, dword ptr fs:[00000030h] 3_2_012FE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FE420 mov eax, dword ptr fs:[00000030h] 3_2_012FE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FE420 mov eax, dword ptr fs:[00000030h] 3_2_012FE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01386420 mov eax, dword ptr fs:[00000030h] 3_2_01386420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01386420 mov eax, dword ptr fs:[00000030h] 3_2_01386420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01386420 mov eax, dword ptr fs:[00000030h] 3_2_01386420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01386420 mov eax, dword ptr fs:[00000030h] 3_2_01386420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01386420 mov eax, dword ptr fs:[00000030h] 3_2_01386420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01386420 mov eax, dword ptr fs:[00000030h] 3_2_01386420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01386420 mov eax, dword ptr fs:[00000030h] 3_2_01386420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01338402 mov eax, dword ptr fs:[00000030h] 3_2_01338402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01338402 mov eax, dword ptr fs:[00000030h] 3_2_01338402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01338402 mov eax, dword ptr fs:[00000030h] 3_2_01338402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132A470 mov eax, dword ptr fs:[00000030h] 3_2_0132A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132A470 mov eax, dword ptr fs:[00000030h] 3_2_0132A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132A470 mov eax, dword ptr fs:[00000030h] 3_2_0132A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138C460 mov ecx, dword ptr fs:[00000030h] 3_2_0138C460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132245A mov eax, dword ptr fs:[00000030h] 3_2_0132245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013BA456 mov eax, dword ptr fs:[00000030h] 3_2_013BA456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E443 mov eax, dword ptr fs:[00000030h] 3_2_0133E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E443 mov eax, dword ptr fs:[00000030h] 3_2_0133E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E443 mov eax, dword ptr fs:[00000030h] 3_2_0133E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E443 mov eax, dword ptr fs:[00000030h] 3_2_0133E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E443 mov eax, dword ptr fs:[00000030h] 3_2_0133E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E443 mov eax, dword ptr fs:[00000030h] 3_2_0133E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E443 mov eax, dword ptr fs:[00000030h] 3_2_0133E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133E443 mov eax, dword ptr fs:[00000030h] 3_2_0133E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012F645D mov eax, dword ptr fs:[00000030h] 3_2_012F645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013344B0 mov ecx, dword ptr fs:[00000030h] 3_2_013344B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138A4B0 mov eax, dword ptr fs:[00000030h] 3_2_0138A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013064AB mov eax, dword ptr fs:[00000030h] 3_2_013064AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013BA49A mov eax, dword ptr fs:[00000030h] 3_2_013BA49A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013004E5 mov ecx, dword ptr fs:[00000030h] 3_2_013004E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137C730 mov eax, dword ptr fs:[00000030h] 3_2_0137C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133273C mov eax, dword ptr fs:[00000030h] 3_2_0133273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133273C mov ecx, dword ptr fs:[00000030h] 3_2_0133273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133273C mov eax, dword ptr fs:[00000030h] 3_2_0133273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133C720 mov eax, dword ptr fs:[00000030h] 3_2_0133C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133C720 mov eax, dword ptr fs:[00000030h] 3_2_0133C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01300710 mov eax, dword ptr fs:[00000030h] 3_2_01300710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01330710 mov eax, dword ptr fs:[00000030h] 3_2_01330710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133C700 mov eax, dword ptr fs:[00000030h] 3_2_0133C700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01308770 mov eax, dword ptr fs:[00000030h] 3_2_01308770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 mov eax, dword ptr fs:[00000030h] 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 mov eax, dword ptr fs:[00000030h] 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 mov eax, dword ptr fs:[00000030h] 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 mov eax, dword ptr fs:[00000030h] 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 mov eax, dword ptr fs:[00000030h] 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 mov eax, dword ptr fs:[00000030h] 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 mov eax, dword ptr fs:[00000030h] 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 mov eax, dword ptr fs:[00000030h] 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 mov eax, dword ptr fs:[00000030h] 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 mov eax, dword ptr fs:[00000030h] 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 mov eax, dword ptr fs:[00000030h] 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310770 mov eax, dword ptr fs:[00000030h] 3_2_01310770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01300750 mov eax, dword ptr fs:[00000030h] 3_2_01300750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342750 mov eax, dword ptr fs:[00000030h] 3_2_01342750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342750 mov eax, dword ptr fs:[00000030h] 3_2_01342750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138E75D mov eax, dword ptr fs:[00000030h] 3_2_0138E75D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01384755 mov eax, dword ptr fs:[00000030h] 3_2_01384755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133674D mov esi, dword ptr fs:[00000030h] 3_2_0133674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133674D mov eax, dword ptr fs:[00000030h] 3_2_0133674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133674D mov eax, dword ptr fs:[00000030h] 3_2_0133674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B47A0 mov eax, dword ptr fs:[00000030h] 3_2_013B47A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013007AF mov eax, dword ptr fs:[00000030h] 3_2_013007AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A678E mov eax, dword ptr fs:[00000030h] 3_2_013A678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013047FB mov eax, dword ptr fs:[00000030h] 3_2_013047FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013047FB mov eax, dword ptr fs:[00000030h] 3_2_013047FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138E7E1 mov eax, dword ptr fs:[00000030h] 3_2_0138E7E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013227ED mov eax, dword ptr fs:[00000030h] 3_2_013227ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013227ED mov eax, dword ptr fs:[00000030h] 3_2_013227ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013227ED mov eax, dword ptr fs:[00000030h] 3_2_013227ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130C7C0 mov eax, dword ptr fs:[00000030h] 3_2_0130C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013807C3 mov eax, dword ptr fs:[00000030h] 3_2_013807C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01336620 mov eax, dword ptr fs:[00000030h] 3_2_01336620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01338620 mov eax, dword ptr fs:[00000030h] 3_2_01338620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131E627 mov eax, dword ptr fs:[00000030h] 3_2_0131E627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130262C mov eax, dword ptr fs:[00000030h] 3_2_0130262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01342619 mov eax, dword ptr fs:[00000030h] 3_2_01342619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131260B mov eax, dword ptr fs:[00000030h] 3_2_0131260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131260B mov eax, dword ptr fs:[00000030h] 3_2_0131260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131260B mov eax, dword ptr fs:[00000030h] 3_2_0131260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131260B mov eax, dword ptr fs:[00000030h] 3_2_0131260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131260B mov eax, dword ptr fs:[00000030h] 3_2_0131260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131260B mov eax, dword ptr fs:[00000030h] 3_2_0131260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131260B mov eax, dword ptr fs:[00000030h] 3_2_0131260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137E609 mov eax, dword ptr fs:[00000030h] 3_2_0137E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01332674 mov eax, dword ptr fs:[00000030h] 3_2_01332674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C866E mov eax, dword ptr fs:[00000030h] 3_2_013C866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C866E mov eax, dword ptr fs:[00000030h] 3_2_013C866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133A660 mov eax, dword ptr fs:[00000030h] 3_2_0133A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133A660 mov eax, dword ptr fs:[00000030h] 3_2_0133A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0131C640 mov eax, dword ptr fs:[00000030h] 3_2_0131C640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013366B0 mov eax, dword ptr fs:[00000030h] 3_2_013366B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133C6A6 mov eax, dword ptr fs:[00000030h] 3_2_0133C6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01304690 mov eax, dword ptr fs:[00000030h] 3_2_01304690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01304690 mov eax, dword ptr fs:[00000030h] 3_2_01304690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137E6F2 mov eax, dword ptr fs:[00000030h] 3_2_0137E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137E6F2 mov eax, dword ptr fs:[00000030h] 3_2_0137E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137E6F2 mov eax, dword ptr fs:[00000030h] 3_2_0137E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137E6F2 mov eax, dword ptr fs:[00000030h] 3_2_0137E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013806F1 mov eax, dword ptr fs:[00000030h] 3_2_013806F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013806F1 mov eax, dword ptr fs:[00000030h] 3_2_013806F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133A6C7 mov ebx, dword ptr fs:[00000030h] 3_2_0133A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133A6C7 mov eax, dword ptr fs:[00000030h] 3_2_0133A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138892A mov eax, dword ptr fs:[00000030h] 3_2_0138892A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0139892B mov eax, dword ptr fs:[00000030h] 3_2_0139892B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138C912 mov eax, dword ptr fs:[00000030h] 3_2_0138C912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012F8918 mov eax, dword ptr fs:[00000030h] 3_2_012F8918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012F8918 mov eax, dword ptr fs:[00000030h] 3_2_012F8918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137E908 mov eax, dword ptr fs:[00000030h] 3_2_0137E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137E908 mov eax, dword ptr fs:[00000030h] 3_2_0137E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A4978 mov eax, dword ptr fs:[00000030h] 3_2_013A4978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A4978 mov eax, dword ptr fs:[00000030h] 3_2_013A4978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138C97C mov eax, dword ptr fs:[00000030h] 3_2_0138C97C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01326962 mov eax, dword ptr fs:[00000030h] 3_2_01326962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01326962 mov eax, dword ptr fs:[00000030h] 3_2_01326962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01326962 mov eax, dword ptr fs:[00000030h] 3_2_01326962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0134096E mov eax, dword ptr fs:[00000030h] 3_2_0134096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0134096E mov edx, dword ptr fs:[00000030h] 3_2_0134096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0134096E mov eax, dword ptr fs:[00000030h] 3_2_0134096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D4940 mov eax, dword ptr fs:[00000030h] 3_2_013D4940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01380946 mov eax, dword ptr fs:[00000030h] 3_2_01380946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013889B3 mov esi, dword ptr fs:[00000030h] 3_2_013889B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013889B3 mov eax, dword ptr fs:[00000030h] 3_2_013889B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013889B3 mov eax, dword ptr fs:[00000030h] 3_2_013889B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013129A0 mov eax, dword ptr fs:[00000030h] 3_2_013129A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013009AD mov eax, dword ptr fs:[00000030h] 3_2_013009AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013009AD mov eax, dword ptr fs:[00000030h] 3_2_013009AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013329F9 mov eax, dword ptr fs:[00000030h] 3_2_013329F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013329F9 mov eax, dword ptr fs:[00000030h] 3_2_013329F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138E9E0 mov eax, dword ptr fs:[00000030h] 3_2_0138E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0130A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0130A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0130A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0130A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0130A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0130A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013349D0 mov eax, dword ptr fs:[00000030h] 3_2_013349D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CA9D3 mov eax, dword ptr fs:[00000030h] 3_2_013CA9D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013969C0 mov eax, dword ptr fs:[00000030h] 3_2_013969C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A483A mov eax, dword ptr fs:[00000030h] 3_2_013A483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A483A mov eax, dword ptr fs:[00000030h] 3_2_013A483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133A830 mov eax, dword ptr fs:[00000030h] 3_2_0133A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01322835 mov eax, dword ptr fs:[00000030h] 3_2_01322835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01322835 mov eax, dword ptr fs:[00000030h] 3_2_01322835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01322835 mov eax, dword ptr fs:[00000030h] 3_2_01322835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01322835 mov ecx, dword ptr fs:[00000030h] 3_2_01322835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01322835 mov eax, dword ptr fs:[00000030h] 3_2_01322835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01322835 mov eax, dword ptr fs:[00000030h] 3_2_01322835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138C810 mov eax, dword ptr fs:[00000030h] 3_2_0138C810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01396870 mov eax, dword ptr fs:[00000030h] 3_2_01396870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01396870 mov eax, dword ptr fs:[00000030h] 3_2_01396870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138E872 mov eax, dword ptr fs:[00000030h] 3_2_0138E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138E872 mov eax, dword ptr fs:[00000030h] 3_2_0138E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01330854 mov eax, dword ptr fs:[00000030h] 3_2_01330854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01304859 mov eax, dword ptr fs:[00000030h] 3_2_01304859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01304859 mov eax, dword ptr fs:[00000030h] 3_2_01304859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01312840 mov ecx, dword ptr fs:[00000030h] 3_2_01312840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138C89D mov eax, dword ptr fs:[00000030h] 3_2_0138C89D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01300887 mov eax, dword ptr fs:[00000030h] 3_2_01300887
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133C8F9 mov eax, dword ptr fs:[00000030h] 3_2_0133C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133C8F9 mov eax, dword ptr fs:[00000030h] 3_2_0133C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CA8E4 mov eax, dword ptr fs:[00000030h] 3_2_013CA8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132E8C0 mov eax, dword ptr fs:[00000030h] 3_2_0132E8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D08C0 mov eax, dword ptr fs:[00000030h] 3_2_013D08C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132EB20 mov eax, dword ptr fs:[00000030h] 3_2_0132EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132EB20 mov eax, dword ptr fs:[00000030h] 3_2_0132EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C8B28 mov eax, dword ptr fs:[00000030h] 3_2_013C8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013C8B28 mov eax, dword ptr fs:[00000030h] 3_2_013C8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137EB1D mov eax, dword ptr fs:[00000030h] 3_2_0137EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137EB1D mov eax, dword ptr fs:[00000030h] 3_2_0137EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137EB1D mov eax, dword ptr fs:[00000030h] 3_2_0137EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137EB1D mov eax, dword ptr fs:[00000030h] 3_2_0137EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137EB1D mov eax, dword ptr fs:[00000030h] 3_2_0137EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137EB1D mov eax, dword ptr fs:[00000030h] 3_2_0137EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137EB1D mov eax, dword ptr fs:[00000030h] 3_2_0137EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137EB1D mov eax, dword ptr fs:[00000030h] 3_2_0137EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137EB1D mov eax, dword ptr fs:[00000030h] 3_2_0137EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D4B00 mov eax, dword ptr fs:[00000030h] 3_2_013D4B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012FCB7E mov eax, dword ptr fs:[00000030h] 3_2_012FCB7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AEB50 mov eax, dword ptr fs:[00000030h] 3_2_013AEB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D2B57 mov eax, dword ptr fs:[00000030h] 3_2_013D2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D2B57 mov eax, dword ptr fs:[00000030h] 3_2_013D2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D2B57 mov eax, dword ptr fs:[00000030h] 3_2_013D2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013D2B57 mov eax, dword ptr fs:[00000030h] 3_2_013D2B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B4B4B mov eax, dword ptr fs:[00000030h] 3_2_013B4B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B4B4B mov eax, dword ptr fs:[00000030h] 3_2_013B4B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013A8B42 mov eax, dword ptr fs:[00000030h] 3_2_013A8B42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01396B40 mov eax, dword ptr fs:[00000030h] 3_2_01396B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01396B40 mov eax, dword ptr fs:[00000030h] 3_2_01396B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013CAB40 mov eax, dword ptr fs:[00000030h] 3_2_013CAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_012F8B50 mov eax, dword ptr fs:[00000030h] 3_2_012F8B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B4BB0 mov eax, dword ptr fs:[00000030h] 3_2_013B4BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013B4BB0 mov eax, dword ptr fs:[00000030h] 3_2_013B4BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310BBE mov eax, dword ptr fs:[00000030h] 3_2_01310BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310BBE mov eax, dword ptr fs:[00000030h] 3_2_01310BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01308BF0 mov eax, dword ptr fs:[00000030h] 3_2_01308BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01308BF0 mov eax, dword ptr fs:[00000030h] 3_2_01308BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01308BF0 mov eax, dword ptr fs:[00000030h] 3_2_01308BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138CBF0 mov eax, dword ptr fs:[00000030h] 3_2_0138CBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132EBFC mov eax, dword ptr fs:[00000030h] 3_2_0132EBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AEBD0 mov eax, dword ptr fs:[00000030h] 3_2_013AEBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01320BCB mov eax, dword ptr fs:[00000030h] 3_2_01320BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01320BCB mov eax, dword ptr fs:[00000030h] 3_2_01320BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01320BCB mov eax, dword ptr fs:[00000030h] 3_2_01320BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01300BCD mov eax, dword ptr fs:[00000030h] 3_2_01300BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01300BCD mov eax, dword ptr fs:[00000030h] 3_2_01300BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01300BCD mov eax, dword ptr fs:[00000030h] 3_2_01300BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01324A35 mov eax, dword ptr fs:[00000030h] 3_2_01324A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01324A35 mov eax, dword ptr fs:[00000030h] 3_2_01324A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133CA24 mov eax, dword ptr fs:[00000030h] 3_2_0133CA24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0132EA2E mov eax, dword ptr fs:[00000030h] 3_2_0132EA2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0138CA11 mov eax, dword ptr fs:[00000030h] 3_2_0138CA11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137CA72 mov eax, dword ptr fs:[00000030h] 3_2_0137CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0137CA72 mov eax, dword ptr fs:[00000030h] 3_2_0137CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_013AEA60 mov eax, dword ptr fs:[00000030h] 3_2_013AEA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133CA6F mov eax, dword ptr fs:[00000030h] 3_2_0133CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133CA6F mov eax, dword ptr fs:[00000030h] 3_2_0133CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0133CA6F mov eax, dword ptr fs:[00000030h] 3_2_0133CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01306A50 mov eax, dword ptr fs:[00000030h] 3_2_01306A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01306A50 mov eax, dword ptr fs:[00000030h] 3_2_01306A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01306A50 mov eax, dword ptr fs:[00000030h] 3_2_01306A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01306A50 mov eax, dword ptr fs:[00000030h] 3_2_01306A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01306A50 mov eax, dword ptr fs:[00000030h] 3_2_01306A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01306A50 mov eax, dword ptr fs:[00000030h] 3_2_01306A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01306A50 mov eax, dword ptr fs:[00000030h] 3_2_01306A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310A5B mov eax, dword ptr fs:[00000030h] 3_2_01310A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01310A5B mov eax, dword ptr fs:[00000030h] 3_2_01310A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01308AA0 mov eax, dword ptr fs:[00000030h] 3_2_01308AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01308AA0 mov eax, dword ptr fs:[00000030h] 3_2_01308AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01356AA4 mov eax, dword ptr fs:[00000030h] 3_2_01356AA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01338A90 mov edx, dword ptr fs:[00000030h] 3_2_01338A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130EA80 mov eax, dword ptr fs:[00000030h] 3_2_0130EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130EA80 mov eax, dword ptr fs:[00000030h] 3_2_0130EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130EA80 mov eax, dword ptr fs:[00000030h] 3_2_0130EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130EA80 mov eax, dword ptr fs:[00000030h] 3_2_0130EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130EA80 mov eax, dword ptr fs:[00000030h] 3_2_0130EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130EA80 mov eax, dword ptr fs:[00000030h] 3_2_0130EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130EA80 mov eax, dword ptr fs:[00000030h] 3_2_0130EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130EA80 mov eax, dword ptr fs:[00000030h] 3_2_0130EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0130EA80 mov eax, dword ptr fs:[00000030h] 3_2_0130EA80
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_00630040 WideCharToMultiByte,GetFileVersionInfoSizeA,GetLastError,GetProcessHeap,HeapAlloc,GetFileVersionInfoA,GetLastError,VerQueryValueA,VerQueryValueA,HeapFree, 7_2_00630040
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_00631720 SetUnhandledExceptionFilter, 7_2_00631720
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_006314D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 7_2_006314D0
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 44.219.53.183 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 66.96.162.129 80 Jump to behavior
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\SOA.pdf.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA.pdf.exe"
Source: C:\Users\user\Desktop\SOA.pdf.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA.pdf.exe" Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: NULL target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: NULL target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread register set: target process: 2580 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Thread register set: target process: 2580 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section unmapped: C:\Windows\SysWOW64\cmstp.exe base address: 620000 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 8B4008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SOA.pdf.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SOA.pdf.exe" Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_00628DB2 AllocateAndInitializeSid,GetModuleHandleA,LoadLibraryExA,GetProcAddress,FreeSid,FreeLibrary, 7_2_00628DB2
Source: explorer.exe, 00000005.00000000.1690318744.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4113780105.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.4116162708.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000002.4113780105.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1680809837.00000000018A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.1680138963.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4113123360.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1Progman$
Source: explorer.exe, 00000005.00000002.4113780105.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1680809837.00000000018A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000002.4113780105.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1680809837.00000000018A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: }Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Users\user\Desktop\SOA.pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SOA.pdf.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0062F80E GetSystemInfo,GetVersionExW, 7_2_0062F80E
Source: C:\Users\user\Desktop\SOA.pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.1737185931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4113294260.0000000003370000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4113244559.0000000003340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4112860100.00000000030A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1679867120.00000000042F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.1737185931.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4113294260.0000000003370000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4113244559.0000000003340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4112860100.00000000030A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1679867120.00000000042F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1430339 Sample: SOA.pdf.exe Startdate: 23/04/2024 Architecture: WINDOWS Score: 100 34 www.9831bsej.xyz 2->34 36 www.wszy.site 2->36 38 12 other IPs or domains 2->38 46 Snort IDS alert for network traffic 2->46 48 Found malware configuration 2->48 50 Malicious sample detected (through community Yara rule) 2->50 54 13 other signatures 2->54 11 SOA.pdf.exe 4 2->11         started        signatures3 52 Performs DNS queries to domains with low reputation 34->52 process4 signatures5 58 Writes to foreign memory regions 11->58 60 Allocates memory in foreign processes 11->60 62 Adds a directory exclusion to Windows Defender 11->62 64 Injects a PE file into a foreign processes 11->64 14 RegSvcs.exe 11->14         started        17 powershell.exe 23 11->17         started        process6 signatures7 72 Modifies the context of a thread in another process (thread injection) 14->72 74 Maps a DLL or memory area into another process 14->74 76 Sample uses process hollowing technique 14->76 80 2 other signatures 14->80 19 explorer.exe 56 1 14->19 injected 78 Loading BitLocker PowerShell Module 17->78 23 WmiPrvSE.exe 17->23         started        25 conhost.exe 17->25         started        process8 dnsIp9 40 www.memejseventhall.com 66.96.162.129, 49742, 80 BIZLAND-SDUS United States 19->40 42 sos-soutien.com 3.33.130.190, 49746, 80 AMAZONEXPANSIONGB United States 19->42 44 www.us-sumatrraslimbellytonic.com 44.219.53.183, 49745, 80 AMAZON-AESUS United States 19->44 56 System process connects to network (likely due to code injection or exploit) 19->56 27 cmstp.exe 19->27         started        signatures10 process11 signatures12 66 Modifies the context of a thread in another process (thread injection) 27->66 68 Maps a DLL or memory area into another process 27->68 70 Tries to detect virtualization through RDTSC time measurements 27->70 30 cmd.exe 1 27->30         started        process13 process14 32 conhost.exe 30->32         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
66.96.162.129
 www.memejseventhall.com United States
29873 BIZLAND-SDUS true
44.219.53.183
 www.us-sumatrraslimbellytonic.com United States
14618 AMAZON-AESUS true
3.33.130.190
 sos-soutien.com United States
8987 AMAZONEXPANSIONGB true

Contacted Domains

Name IP Active
www.memejseventhall.com 66.96.162.129 true
www.us-sumatrraslimbellytonic.com 44.219.53.183 true
sos-soutien.com 3.33.130.190 true
pharjenk.n.cdn8899.com 103.251.113.254 true
www.id91920.com 15.197.240.20 true
www.9831bsej.xyz unknown unknown
www.587659.com unknown unknown
www.teomanyildirim.com unknown unknown
www.wszy.site unknown unknown
www.king1122.com unknown unknown
www.askhelpsecur.us unknown unknown
www.sos-soutien.com unknown unknown
www.buywestlakevillagehomes.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.memejseventhall.com/fs83/?lhud=ToNIa34Alsx2v+kP6qveLAZbkLXU5ZMpLFvBeW/RhKMtCd0Ai1yKtBy78SYXuxTiyqZf&2dF=2dedQvcpFjwH0Xi true
  • Avira URL Cloud: malware
 unknown
www.buywestlakevillagehomes.com/fs83/ true
  • Avira URL Cloud: safe
 low
http://www.us-sumatrraslimbellytonic.com/fs83/?lhud=uoTIvCnC3UdpXVZjGRZ1TpnD0C1ctHvLQTQ5yuyXeiefmGaZCVbnGHhjWY2HlXeR1Arx&2dF=2dedQvcpFjwH0Xi true
  • Avira URL Cloud: safe
 unknown