Windows Analysis Report
DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe

Overview

General Information

Sample name: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe
Analysis ID: 1432022
MD5: 840cbf490ce0600e1057f72949a37c73
SHA1: 151c7c81a8f1e9dd889eef12e8c4ca6749495dac
SHA256: b09a0b160629c46cd40123518cf4beed875c630f8836e2fea5d894c43fd58093
Tags: exe
Infos:

Detection

AgentTesla, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Contains functionality to log keystrokes (.Net Source)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to detect virtual machines (SGDT)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates processes with suspicious names
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Avira: detected
Antivirus detection for URL or domain
Source: http://mail.clslk.com Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Avira: detection malicious, Label: HEUR/AGEN.1305452
Found malware configuration
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.clslk.com", "Username": "gm@clslk.com", "Password": "NUZRATHinam1978"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Virustotal: Detection: 51% Perma Link
Multi AV Scanner detection for submitted file
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Virustotal: Detection: 51% Perma Link
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe ReversingLabs: Detection: 44%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: oZr.pdb source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr, LJAGvecDW.exe.1.dr
Source: Binary string: System.Data.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Xml.ni.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: Accessibility.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.ni.pdbRSDS source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: mscorlib.pdbx source: WER93E1.tmp.dmp.22.dr
Source: Binary string: RegSvcs.pdb, source: boqXv.exe, 00000012.00000000.2398561366.0000000000F92000.00000002.00000001.01000000.0000000E.sdmp, boqXv.exe.9.dr
Source: Binary string: oZr.pdb> source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Configuration.ni.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.pdb(N source: WER93E1.tmp.dmp.22.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: RegSvcs.pdb source: boqXv.exe, 00000012.00000000.2398561366.0000000000F92000.00000002.00000001.01000000.0000000E.sdmp, boqXv.exe.9.dr
Source: Binary string: System.Data.ni.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Configuration.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Core.pdbH source: WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Xml.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Xml.ni.pdbRSDS# source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Core.ni.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Windows.Forms.pdbPq source: WER6D7D.tmp.dmp.12.dr
Source: Binary string: System.Windows.Forms.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: mscorlib.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Drawing.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: mscorlib.ni.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Data.ni.pdbRSDS source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Xml.pdb< source: WER6D7D.tmp.dmp.12.dr
Source: Binary string: System.Core.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Core.pdbMZ source: WER6D7D.tmp.dmp.12.dr
Source: Binary string: Accessibility.pdb< source: WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Drawing.pdb$ source: WER93E1.tmp.dmp.22.dr
Source: Binary string: oZr.pdbSHA2560Q source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, LJAGvecDW.exe.1.dr
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Data.pdb, source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.ni.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.6:49721 -> 50.87.253.239:587
Source: Traffic Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.6:49721 -> 50.87.253.239:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.6:49731 -> 50.87.253.239:587
Source: Traffic Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.6:49731 -> 50.87.253.239:587
Yara detected Generic Downloader
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.46a9af0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, type: UNPACKEDPE
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:49721 -> 50.87.253.239:587
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 50.87.253.239 50.87.253.239
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.6:49721 -> 50.87.253.239:587
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: mail.clslk.com
Source: RegSvcs.exe, 00000009.00000002.2413879455.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000014.00000002.3497093745.0000000002C97000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.clslk.com
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, 00000001.00000002.2353195129.0000000002AED000.00000004.00000800.00020000.00000000.sdmp, LJAGvecDW.exe, 0000000D.00000002.2446819021.000000000279D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.12.dr String found in binary or memory: http://upx.sf.net
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, 00000001.00000002.2353913822.0000000004467000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2408863258.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, umlRMRbjNqD.cs .Net Code: fKv0R
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.46a9af0.5.raw.unpack, umlRMRbjNqD.cs .Net Code: fKv0R

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.46a9af0.5.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.46a9af0.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe
Detected potential crypto function
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_05041808 1_2_05041808
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_050417F8 1_2_050417F8
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_0702A688 1_2_0702A688
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_07029CC8 1_2_07029CC8
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_07026CD8 1_2_07026CD8
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_070239C0 1_2_070239C0
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_0702C378 1_2_0702C378
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_0702C388 1_2_0702C388
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_0702A3E0 1_2_0702A3E0
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_0702A3F0 1_2_0702A3F0
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_07027271 1_2_07027271
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_07027280 1_2_07027280
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_07029CB8 1_2_07029CB8
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_07349BC0 1_2_07349BC0
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_07347A20 1_2_07347A20
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_0734C900 1_2_0734C900
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_0734AA60 1_2_0734AA60
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_0734BED0 1_2_0734BED0
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_0734F148 1_2_0734F148
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_07340006 1_2_07340006
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_07340040 1_2_07340040
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_0734D8A8 1_2_0734D8A8
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_0734BC88 1_2_0734BC88
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_073E7728 1_2_073E7728
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_073EB6F0 1_2_073EB6F0
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_073E3560 1_2_073E3560
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_073E4C08 1_2_073E4C08
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_073E2CF0 1_2_073E2CF0
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_073E4BF8 1_2_073E4BF8
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_073E3128 1_2_073E3128
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_073E5040 1_2_073E5040
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_078FC550 1_2_078FC550
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_078FE6F0 1_2_078FE6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_0131A3D8 9_2_0131A3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_0131D658 9_2_0131D658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_01319810 9_2_01319810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_01314AD0 9_2_01314AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_01313EB8 9_2_01313EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_01314200 9_2_01314200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_0652B5A0 9_2_0652B5A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_06529F6C 9_2_06529F6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_06530E60 9_2_06530E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_06539F80 9_2_06539F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_065343F8 9_2_065343F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_06533398 9_2_06533398
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_06535B80 9_2_06535B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_06539038 9_2_06539038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_0653C1A0 9_2_0653C1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_065354A0 9_2_065354A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_06533AF0 9_2_06533AF0
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_025C1CC4 13_2_025C1CC4
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_025C01A0 13_2_025C01A0
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_025C0B50 13_2_025C0B50
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_025C0B60 13_2_025C0B60
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_025C2B11 13_2_025C2B11
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_02601808 13_2_02601808
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_026017F8 13_2_026017F8
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_04D3C550 13_2_04D3C550
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_04D3E6F0 13_2_04D3E6F0
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_06DB7A20 13_2_06DB7A20
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_06DB9BC0 13_2_06DB9BC0
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_06DBC900 13_2_06DBC900
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_06DBBED0 13_2_06DBBED0
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_06DBAA60 13_2_06DBAA60
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_06DBBC88 13_2_06DBBC88
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_06DBD8A8 13_2_06DBD8A8
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_06DB0040 13_2_06DB0040
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_06DB0007 13_2_06DB0007
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_06DBF148 13_2_06DBF148
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_084B910B 13_2_084B910B
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_084B5040 13_2_084B5040
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_084BA958 13_2_084BA958
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_084B3128 13_2_084B3128
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_084B4BF8 13_2_084B4BF8
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_084B83B8 13_2_084B83B8
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_084B4C08 13_2_084B4C08
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_084B2CF0 13_2_084B2CF0
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_084B3560 13_2_084B3560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_051ED650 20_2_051ED650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_051EA3D0 20_2_051EA3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_051E3EB8 20_2_051E3EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_051E4AD0 20_2_051E4AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_051E4200 20_2_051E4200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_063AB5A0 20_2_063AB5A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_063A9D54 20_2_063A9D54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_063B9F80 20_2_063B9F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_063B5B80 20_2_063B5B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_063B43F8 20_2_063B43F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_063B902B 20_2_063B902B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_063B0040 20_2_063B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_063BE190 20_2_063BE190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_063BC460 20_2_063BC460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_063B54A0 20_2_063B54A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_063B3ADB 20_2_063B3ADB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 20_2_063B3398 20_2_063B3398
One or more processes crash
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6532 -s 1400
Sample file is different than original file name gathered from version info
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, 00000001.00000002.2361303192.0000000007350000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, 00000001.00000002.2353195129.0000000002B02000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename9e4810db-acaa-47dc-a281-6153255fd520.exe4 vs DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, 00000001.00000000.2238446670.00000000006D0000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameoZr.exe. vs DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, 00000001.00000002.2358846503.0000000006F95000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, 00000001.00000002.2353913822.0000000004467000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename9e4810db-acaa-47dc-a281-6153255fd520.exe4 vs DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, 00000001.00000002.2353913822.0000000004467000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, 00000001.00000002.2352092660.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Binary or memory string: OriginalFilenameoZr.exe. vs DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe
Uses 32bit PE files
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.46a9af0.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.46a9af0.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: LJAGvecDW.exe.1.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.3a79970.3.raw.unpack, V4uC3Iifq56IKQcfry.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.3a79970.3.raw.unpack, V4uC3Iifq56IKQcfry.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.71f0000.6.raw.unpack, V4uC3Iifq56IKQcfry.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.71f0000.6.raw.unpack, V4uC3Iifq56IKQcfry.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, v9Lsz.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, VFo.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, 5FJ0H20tobu.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, NtdoTGO.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, XBsYgp.cs Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, AwxUa2Na.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, Y5gZfkJXWveVrlnV3i.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, pG8amSqlnJ4quD2sgH.cs Security API names: _0020.SetAccessControl
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, pG8amSqlnJ4quD2sgH.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, pG8amSqlnJ4quD2sgH.cs Security API names: _0020.AddAccessRule
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.2ad68cc.1.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7220000.7.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.2ac652c.0.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@25/28@1/1
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File created: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5276:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3260:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2744
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5616:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5828:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6872:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6532
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6448:120:WilError_03
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File created: C:\Users\user\AppData\Local\Temp\tmp87CB.tmp Jump to behavior
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Virustotal: Detection: 51%
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File read: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe "C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe"
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LJAGvecDW.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LJAGvecDW" /XML "C:\Users\user\AppData\Local\Temp\tmp87CB.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6532 -s 1400
Source: unknown Process created: C:\Users\user\AppData\Roaming\LJAGvecDW.exe C:\Users\user\AppData\Roaming\LJAGvecDW.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LJAGvecDW" /XML "C:\Users\user\AppData\Local\Temp\tmpA44C.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe "C:\Users\user\AppData\Roaming\boqXv\boqXv.exe"
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 1760
Source: unknown Process created: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe "C:\Users\user\AppData\Roaming\boqXv\boqXv.exe"
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe" Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LJAGvecDW.exe" Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LJAGvecDW" /XML "C:\Users\user\AppData\Local\Temp\tmp87CB.tmp" Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LJAGvecDW" /XML "C:\Users\user\AppData\Local\Temp\tmpA44C.tmp"
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: oZr.pdb source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr, LJAGvecDW.exe.1.dr
Source: Binary string: System.Data.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Xml.ni.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: Accessibility.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.ni.pdbRSDS source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: mscorlib.pdbx source: WER93E1.tmp.dmp.22.dr
Source: Binary string: RegSvcs.pdb, source: boqXv.exe, 00000012.00000000.2398561366.0000000000F92000.00000002.00000001.01000000.0000000E.sdmp, boqXv.exe.9.dr
Source: Binary string: oZr.pdb> source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Configuration.ni.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.pdb(N source: WER93E1.tmp.dmp.22.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: RegSvcs.pdb source: boqXv.exe, 00000012.00000000.2398561366.0000000000F92000.00000002.00000001.01000000.0000000E.sdmp, boqXv.exe.9.dr
Source: Binary string: System.Data.ni.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Configuration.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Core.pdbH source: WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Xml.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Xml.ni.pdbRSDS# source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Core.ni.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Windows.Forms.pdbPq source: WER6D7D.tmp.dmp.12.dr
Source: Binary string: System.Windows.Forms.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: mscorlib.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Drawing.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: mscorlib.ni.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Data.ni.pdbRSDS source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Xml.pdb< source: WER6D7D.tmp.dmp.12.dr
Source: Binary string: System.Core.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Core.pdbMZ source: WER6D7D.tmp.dmp.12.dr
Source: Binary string: Accessibility.pdb< source: WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Drawing.pdb$ source: WER93E1.tmp.dmp.22.dr
Source: Binary string: oZr.pdbSHA2560Q source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe, LJAGvecDW.exe.1.dr
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Data.pdb, source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.ni.pdb source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WER6D7D.tmp.dmp.12.dr, WER93E1.tmp.dmp.22.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.3a79970.3.raw.unpack, V4uC3Iifq56IKQcfry.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.71f0000.6.raw.unpack, V4uC3Iifq56IKQcfry.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, pG8amSqlnJ4quD2sgH.cs .Net Code: jtYClDwqj2 System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Static PE information: 0xF3ED4585 [Sun Sep 6 21:28:37 2099 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_07343E3A push ds; ret 1_2_07343E3B
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_078F7E88 pushad ; iretd 1_2_078F7E91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 9_2_0652FD30 push es; ret 9_2_0652FD40
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_04D37E88 pushad ; iretd 13_2_04D37E91
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Code function: 13_2_06DB3E3A push ds; ret 13_2_06DB3E3B
Source: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Static PE information: section name: .text entropy: 7.954566370427042
Source: LJAGvecDW.exe.1.dr Static PE information: section name: .text entropy: 7.954566370427042
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, FQjI6xswpurevFyFrHc.cs High entropy of concatenated method names: 'TaR04YGBWa', 'JE60rW2lwN', 'x9P0loTJFg', 'j2Y061B2Pm', 'WTS0jrC5Di', 'sb30fHsMys', 'YRg0b1cPQP', 'Tbv0JUSP9m', 'UiK0csHUtB', 'BKM0kRrSva'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, j8KIOynUvUE6avXM9q.cs High entropy of concatenated method names: 'a5cE5JhV0y', 'O0kEmuusm4', 'NBpE8McgXp', 'xmV8tuZ00P', 'ehL8zTgoyZ', 'OE3Ewt6Rq7', 'nkZEsWa06H', 'MPvEgOPMra', 'kWdEKmUiy2', 'q7BECOE50G'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, aUXYCqtwfT655GPHKy.cs High entropy of concatenated method names: 'V4I0ssK2j6', 'iqG0KvbGnL', 'Eas0CMhmiU', 'srF05XMIo2', 'ybG0uKyBeB', 'fO10MO0xMx', 'INM08CaMx7', 'W0iNYBZ60E', 'fTGNHJ7mbu', 'MLfNdXwkB2'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, BO2pWNVo2dQDk4L5AL.cs High entropy of concatenated method names: 'i1R8URcB7n', 'cps8ukfh0q', 'vmd8MUCSRh', 'Maw8Ees7oi', 'MeP8qYbdyf', 'DFqMxM5lU4', 'EnLMBqq6Lf', 'TkKMYEBqnZ', 'FqvMHdCBsV', 'cBdMdmYaBa'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, pG8amSqlnJ4quD2sgH.cs High entropy of concatenated method names: 'g3kKUEi0kL', 'EexK5Km5BK', 'hiSKu5l7US', 'BPuKmFvxLr', 'pLNKMUCu0E', 'PHdK8hPbmC', 'rV8KEXanZx', 'zaqKqEUHg5', 'Y3YKyGuJ3v', 'VsLKpoNoV9'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, Dyi1eossp9DjXPSKtmZ.cs High entropy of concatenated method names: 'ToString', 'aBMDKU3YAH', 'IcqDC9B0d4', 'AjoDUZ9FWQ', 'zwWD5OtHYM', 'CDqDucI4pk', 'Wg0DmbYfL4', 'undDME2mdO', 'GNBuZcrBmeyVPIG4W4P', 'WtkCH8rIx9p0wrbp1N2'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, SSUKlkc9axQbVVUYQj.cs High entropy of concatenated method names: 'tSJm60lQ9B', 'qGcmfS55yP', 'YRamJljIdl', 'QosmcyP9YV', 'qs4mvd59Yf', 'Hu3mGlCk1g', 'NtvmFubWBr', 'NjbmNXq5pc', 'eQIm0cXkp6', 'Im6mDSFvlU'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, PMN4xKPUAJtFCI5QgV.cs High entropy of concatenated method names: 'Fu8FpBnCt7', 't1UFXh190g', 'ToString', 'oeHF5qxWuY', 'fBcFuPQYwZ', 'sGLFmT9aSf', 'OpDFMsvEFD', 'LwDF8juNLg', 'WM4FEdQm9c', 'f83FqpcH9E'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, wg8p4uLkAXM2VBKjl5.cs High entropy of concatenated method names: 'ToString', 'qVSGWr5qJ9', 'tAAGeW69dc', 'rlFGSqraJc', 'KT1GIYlwrZ', 'rSGGAwI2GA', 'mjsG7hpvF8', 'YR3Gn0Qkx3', 'q9kGZ9DhNU', 'nLMG1WVoex'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, tl2aMA934ntNhTkLCI.cs High entropy of concatenated method names: 'RLmvaCp025', 'jiKvRlZVVZ', 'VVyv9N3jeP', 'mAwvTjl3i8', 'oZXvemKQLp', 'CuqvS8OCnQ', 'G40vIdTJJ1', 'twavAQASWN', 'KP1v74Ofux', 'JkHvnb6exE'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, T4WMKYhPVCAIdTeZWR.cs High entropy of concatenated method names: 'H8O3JpoJpZ', 'oca3cT660v', 'Yyg3VCU5ql', 'dxL3ebfctR', 'CSw3IhRwdU', 'o2R3AIjGTJ', 'bh73nDb7gi', 'TdC3ZlfnGw', 'Si63aXytfh', 'f3J3Wau9kV'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, FUNVgrCo3A2OAg79xZ.cs High entropy of concatenated method names: 'q5tsE5gZfk', 'nWvsqeVrln', 'E9aspxQbVV', 'eYQsXjC67H', 'xdosvV5fO2', 'mWNsGo2dQD', 'uVaqmUQNJ5sB4IKWet', 'xR8HX1iPMaxy2RjvWO', 'aYasswksxX', 'LuUsKRu6hY'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, d67HrGkKQkART4doV5.cs High entropy of concatenated method names: 'ITrMjXGD6v', 'rRjMbiCYl5', 'U4umSpdWRi', 'MLYmIMhHwa', 'avmmAwi1GJ', 'wX0m7HpXcQ', 'JpFmnEGnAo', 'sgCmZDo0yf', 'TaNm17Ynmj', 'mLSma8g9DN'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, TRjKYPgmr4NNIidoLj.cs High entropy of concatenated method names: 'yi1lfgMB2', 'VlY62I1Vv', 'fRffswoGl', 'DP7bhYhYD', 'gcHcW3x80', 'J5GkehBHH', 'UHdoQLfGlDFexkPWVW', 'tdkknV4RIKC0xLVZlg', 'eYxN2VaHh', 'WTuDG1xpL'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, Pnsbg1sK7lr0S11sX87.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OqgD9QjnaM', 'PjrDTiwK7C', 'vTkDLqoyn1', 'ztUDPyVqqD', 'aMaDxrKTfZ', 'NSlDBACiEL', 'tC8DY0OTop'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, Y5gZfkJXWveVrlnV3i.cs High entropy of concatenated method names: 'KI2u9A8Ee6', 'UsiuTAtGc3', 'NRouL1N21d', 'PEluPZkRxb', 'nILuxD6fud', 'E6HuBK5aaZ', 'UOauYJGDYt', 'rCxuHaTyIk', 'j4dud7gA5b', 'kmXutJn61N'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, gtcrRxH52rIVWQSJlQ.cs High entropy of concatenated method names: 'dWLN5yvta7', 'x3FNubpG1Y', 'kLiNmIKfHf', 'AnkNMiKces', 'NaGN8fHRF5', 'vGMNEuopwH', 'cExNq0w6O8', 'GFhNywZpf3', 'gBFNpWq9i5', 'k2hNXwnxqG'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, kCEvdfBXVjP5RGAHJe.cs High entropy of concatenated method names: 'p87FHcClqE', 'DVtFt9xnlK', 'IFpNwkVdMQ', 'pU2Nsgl2dT', 'lmdFWaQc8q', 'WskFR4KPOx', 'D7YFhY4jBp', 'jWDF9KWUXL', 'CFqFT0JHa2', 'z61FLWotUB'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, mjuNBZ1EFXVl4IlIcE.cs High entropy of concatenated method names: 'HkME4ISx4C', 'JC7Erlh785', 'WMZEl7wyPU', 'zA6E6HOKxo', 'duZEjeEoW6', 'nrFEfYi7Ry', 'VWNEbuHh1F', 'gIGEJlMLqf', 'BYbEcU14x9', 'eNFEkp0JYl'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, hDQ0TDdW0HH4oWZIbA.cs High entropy of concatenated method names: 'aX6NVnPpyU', 'Rg7NefD9KN', 'v5bNSqp0sq', 'InjNIkj3Rb', 'ShFN9kNVyG', 'PQgNA5jsBg', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.7350000.8.raw.unpack, pN8dXwurL9ll7OKPvM.cs High entropy of concatenated method names: 'Dispose', 'WDIsdbbauQ', 'X1pgeyy5IM', 'hjg22Wh0Qv', 'KutstcrRx5', 'trIszVWQSJ', 'ProcessDialogKey', 'zQMgwDQ0TD', 'O0HgsH4oWZ', 'IbAggwUXYC'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.3a79970.3.raw.unpack, V4uC3Iifq56IKQcfry.cs High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.3a79970.3.raw.unpack, vpednoN8EZgsJ4TDwx.cs High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.71f0000.6.raw.unpack, V4uC3Iifq56IKQcfry.cs High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.71f0000.6.raw.unpack, vpednoN8EZgsJ4TDwx.cs High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'
Creates processes with suspicious names
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File created: \dhl - overdue account notice - 1301669350.exe
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File created: \dhl - overdue account notice - 1301669350.exe
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File created: \dhl - overdue account notice - 1301669350.exe
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File created: \dhl - overdue account notice - 1301669350.exe
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File created: \dhl - overdue account notice - 1301669350.exe
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File created: \dhl - overdue account notice - 1301669350.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File created: \dhl - overdue account notice - 1301669350.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File created: \dhl - overdue account notice - 1301669350.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File created: \dhl - overdue account notice - 1301669350.exe Jump to behavior
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File created: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Jump to dropped file
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe File created: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LJAGvecDW" /XML "C:\Users\user\AppData\Local\Temp\tmp87CB.tmp"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run boqXv Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run boqXv Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe:Zone.Identifier read attributes | delete
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe PID: 6532, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: LJAGvecDW.exe PID: 2744, type: MEMORYSTR
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory allocated: 1070000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory allocated: 2A70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory allocated: 2990000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory allocated: 9060000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory allocated: 7A00000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory allocated: A060000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory allocated: B060000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory allocated: B590000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory allocated: 9060000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory allocated: AF0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory allocated: 2720000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory allocated: C10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory allocated: 8680000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory allocated: 6EC0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory allocated: 9680000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory allocated: A680000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory allocated: AB90000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory allocated: 8680000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Memory allocated: 17B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Memory allocated: 3320000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Memory allocated: 1830000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Memory allocated: 1540000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Memory allocated: 3390000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Memory allocated: 30E0000 memory reserve | memory write watch
Contains functionality to detect virtual machines (SGDT)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Code function: 1_2_078FF508 sgdt fword ptr [edi] 1_2_078FF508
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2780 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4487 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 517 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Window / User API: threadDelayed 2128 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Window / User API: threadDelayed 894 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Window / User API: threadDelayed 766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Window / User API: threadDelayed 3019
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5676 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1080 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4616 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 420 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe TID: 2144 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe TID: 2184 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99750 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99574 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99458 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99250 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99140 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99031 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98921 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98811 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98689 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98563 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98438 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98313 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98203 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98094 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 97969 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 97859 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 97749 Jump to behavior
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99202
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 99093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98106
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 98000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Thread delayed: delay time: 922337203685477
Source: Amcache.hve.12.dr Binary or memory string: VMware
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.12.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegSvcs.exe, 00000009.00000002.2413533818.0000000001448000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000014.00000002.3506077772.0000000006260000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.12.dr Binary or memory string: vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.12.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr Binary or memory string: VMware20,1
Source: LJAGvecDW.exe, 0000000D.00000002.2452107240.0000000006C24000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}=
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process queried: DebugPort
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe"
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LJAGvecDW.exe"
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe" Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LJAGvecDW.exe" Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A
Writes to foreign memory regions
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000 Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000 Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000 Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: E1C008 Jump to behavior
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: D62008
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe" Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\LJAGvecDW.exe" Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LJAGvecDW" /XML "C:\Users\user\AppData\Local\Temp\tmp87CB.tmp" Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LJAGvecDW" /XML "C:\Users\user\AppData\Local\Temp\tmpA44C.tmp"
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Queries volume information: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Queries volume information: C:\Users\user\AppData\Roaming\LJAGvecDW.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LJAGvecDW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Queries volume information: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Queries volume information: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\boqXv\boqXv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.12.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.46a9af0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.46a9af0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.2413879455.0000000002FA2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2408863258.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2413879455.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.3497093745.0000000002C8F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.3497093745.0000000002C97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2413879455.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.3497093745.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2353913822.0000000004467000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe PID: 6532, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 5560, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 5656, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.71f0000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.71f0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.3a79970.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.3a79970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.2353913822.0000000003A79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2359343012.00000000071F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\FTP Navigator\Ftplist.txt
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Yara detected Credential Stealer
Source: Yara match File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.46a9af0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.46a9af0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.2408863258.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2413879455.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.3497093745.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2353913822.0000000004467000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe PID: 6532, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 5560, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 5656, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.46a9af0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.46a9af0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.466ead0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.2413879455.0000000002FA2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2408863258.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2413879455.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.3497093745.0000000002C8F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.3497093745.0000000002C97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2413879455.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.3497093745.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2353913822.0000000004467000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe PID: 6532, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 5560, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 5656, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.71f0000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.71f0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.3a79970.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe.3a79970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.2353913822.0000000003A79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2359343012.00000000071F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1432022 Sample: DHL - OVERDUE ACCOUNT NOTIC... Startdate: 26/04/2024 Architecture: WINDOWS Score: 100 55 mail.clslk.com 2->55 59 Snort IDS alert for network traffic 2->59 61 Found malware configuration 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 16 other signatures 2->65 8 DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe 7 2->8         started        12 LJAGvecDW.exe 2->12         started        14 boqXv.exe 2->14         started        16 boqXv.exe 2->16         started        signatures3 process4 file5 51 C:\Users\user\AppData\Roaming\LJAGvecDW.exe, PE32 8->51 dropped 53 C:\Users\user\AppData\Local\...\tmp87CB.tmp, XML 8->53 dropped 81 Writes to foreign memory regions 8->81 83 Allocates memory in foreign processes 8->83 85 Adds a directory exclusion to Windows Defender 8->85 87 Injects a PE file into a foreign processes 8->87 18 RegSvcs.exe 1 4 8->18         started        23 powershell.exe 23 8->23         started        25 powershell.exe 23 8->25         started        37 2 other processes 8->37 89 Antivirus detection for dropped file 12->89 91 Multi AV Scanner detection for dropped file 12->91 93 Machine Learning detection for dropped file 12->93 27 RegSvcs.exe 12->27         started        29 schtasks.exe 12->29         started        31 WerFault.exe 12->31         started        33 conhost.exe 14->33         started        35 conhost.exe 16->35         started        signatures6 process7 dnsIp8 57 mail.clslk.com 50.87.253.239, 49721, 49731, 587 UNIFIEDLAYER-AS-1US United States 18->57 49 C:\Users\user\AppData\Roaming\...\boqXv.exe, PE32 18->49 dropped 67 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 18->67 69 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->69 71 Loading BitLocker PowerShell Module 23->71 39 conhost.exe 23->39         started        41 WmiPrvSE.exe 23->41         started        43 conhost.exe 25->43         started        73 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 27->73 75 Tries to steal Mail credentials (via file / registry access) 27->75 77 Tries to harvest and steal ftp login credentials 27->77 79 Tries to harvest and steal browser information (history, passwords, etc) 27->79 45 conhost.exe 29->45         started        47 conhost.exe 37->47         started        file9 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
50.87.253.239
 mail.clslk.com United States
46606 UNIFIEDLAYER-AS-1US true

Contacted Domains

Name IP Active
mail.clslk.com 50.87.253.239 true