Analysis Report HAWB AND INV.exe

Overview

General Information

Sample Name: HAWB AND INV.exe
Analysis ID: 402848
MD5: 42662765a94ce5ece11529509f937711
SHA1: da57dd4c137c47fc9b906caaf067c6ed13fa2da6
SHA256: 2138325dd5e2825ee4086187a944af336476b0327e1ddae7563bb24523836e08
Tags: exe
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses ipconfig to lookup or modify the Windows network settings
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to detect virtual machines (SLDT)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 0000000A.00000002.473823367.0000000000C50000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.alldaazz.com/maw9/"], "decoy": ["jaimericart.com", "mayavantcard.com", "romanzava.site", "forefrontunderground.com", "grafikirmarketing.com", "airpoppoff.com", "captureq.com", "vph.ventures", "historiclocation.com", "theoxfordway.com", "springersells.com", "huther.mobi", "networkingmaderas.com", "reggatech.com", "dollfacela.com", "moneycrypt.net", "calidad-precio.net", "hamnsk165.com", "victoriabrownrealtor.com", "itechfreak.com", "bernardocammarata.com", "alfredoarlington.com", "rencontre-montpellier.com", "vipbrandwatch.info", "nhahangminhcuong.com", "senmec23.com", "onemoreusa.com", "dinkoistmatrimony.com", "ideasparatubebe.com", "pozickyauveryinfossk.com", "buildingba.com", "heoslight.com", "ventadecalsotsdevalls.com", "app-cintavcsuges.com", "culturaenmistacones.com", "whyiamvoting.com", "blackopstravel.club", "poorwhitetrashlivesmatters.com", "beachrockisland.com", "natrium-ionen-akkus.com", "noxi.store", "whichrace.com", "mindfulprovision.com", "nznatureguides.com", "fullautoimage.com", "sharonbakcht.com", "ournursingdegreesworld.com", "parismedspas.com", "premier-moment.info", "curvygirlholiday.com", "getsuperyouth.com", "177palmer.com", "headstronghairstudio.com", "sasdrawing.com", "drinkhydrateyourcoffee.com", "globalifier.com", "protocolpolitician.com", "edinglow.com", "isimplix.com", "trendylifefashion.com", "ferhou.com", "ellarewster.club", "ecosanhn.com", "newedulist.com"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe ReversingLabs: Detection: 21%
Multi AV Scanner detection for submitted file
Source: HAWB AND INV.exe ReversingLabs: Detection: 21%
Yara detected FormBook
Source: Yara match File source: 0000000A.00000002.473823367.0000000000C50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.593665337.0000000000880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.470161659.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.482267255.00000000014E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.591815076.0000000000110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.350474951.0000000003CE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.593621716.0000000000850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 10.2.HAWB AND INV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.HAWB AND INV.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HAWB AND INV.exe.3d81880.3.raw.unpack, type: UNPACKEDPE
Antivirus or Machine Learning detection for unpacked file
Source: 10.2.HAWB AND INV.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: HAWB AND INV.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: HAWB AND INV.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: ipconfig.pdb source: HAWB AND INV.exe, 0000000A.00000002.485361222.0000000003100000.00000040.00000001.sdmp
Source: Binary string: ipconfig.pdbGCTL source: HAWB AND INV.exe, 0000000A.00000002.485361222.0000000003100000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 0000000B.00000000.426929861.000000000DC20000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: HAWB AND INV.exe, 0000000A.00000002.479054770.00000000012CF000.00000040.00000001.sdmp, ipconfig.exe, 00000017.00000003.473141653.00000000008F0000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: HAWB AND INV.exe, ipconfig.exe
Source: Binary string: wscui.pdb source: explorer.exe, 0000000B.00000000.426929861.000000000DC20000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 4x nop then pop esi 10_2_00415836
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 4x nop then pop edi 10_2_004162B1
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 4x nop then pop edi 10_2_00415680
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 4x nop then pop esi 23_2_00125836
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 4x nop then pop edi 23_2_001262B1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 4x nop then pop edi 23_2_00125680

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.alldaazz.com/maw9/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /maw9/?AVF=4eDAg+VUuFTPb+HpMV2XwHXrAkW6c8A/v4D4zAieFew51h9R0F5m+f+tz7m/68XBKeAB57yd0w==&6l=sHbLpdw8x0Nx4 HTTP/1.1Host: www.dinkoistmatrimony.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /maw9/?AVF=6+c9WwA91vc3q1qPV/bxdb4jLCwfrBo6mkGAjXedmMMeaWqNVTNOJ33lEW7rMTYT0EzxW77dCg==&6l=sHbLpdw8x0Nx4 HTTP/1.1Host: www.premier-moment.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /maw9/?AVF=cbTyfQFVyV4qwzSuB5gkHhMhd4ZKxxzMSggVhGr4392xKRAUAYS1aRQvNzIyvi+llhoR0m7eyA==&6l=sHbLpdw8x0Nx4 HTTP/1.1Host: www.ecosanhn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /maw9/?AVF=ueXSnp9RuZV4VGv1GREwgsKbz6ngTp3QynINalfLY22/qL3buQO/ZY9WhadtjkGC+9EglwJKpA==&6l=sHbLpdw8x0Nx4 HTTP/1.1Host: www.curvygirlholiday.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /maw9/?AVF=CxDYGZqaFGf+wggxXYaRsXxHYh0vkMvLuxQU/eiz8BKY71rUvugXdjEA5Q+gRIVecMz1lX5ZhQ==&6l=sHbLpdw8x0Nx4 HTTP/1.1Host: www.networkingmaderas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ASDETUKhttpwwwheficedcomGB ASDETUKhttpwwwheficedcomGB
Source: Joe Sandbox View ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS
Source: global traffic HTTP traffic detected: GET /maw9/?AVF=4eDAg+VUuFTPb+HpMV2XwHXrAkW6c8A/v4D4zAieFew51h9R0F5m+f+tz7m/68XBKeAB57yd0w==&6l=sHbLpdw8x0Nx4 HTTP/1.1Host: www.dinkoistmatrimony.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /maw9/?AVF=6+c9WwA91vc3q1qPV/bxdb4jLCwfrBo6mkGAjXedmMMeaWqNVTNOJ33lEW7rMTYT0EzxW77dCg==&6l=sHbLpdw8x0Nx4 HTTP/1.1Host: www.premier-moment.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /maw9/?AVF=cbTyfQFVyV4qwzSuB5gkHhMhd4ZKxxzMSggVhGr4392xKRAUAYS1aRQvNzIyvi+llhoR0m7eyA==&6l=sHbLpdw8x0Nx4 HTTP/1.1Host: www.ecosanhn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /maw9/?AVF=ueXSnp9RuZV4VGv1GREwgsKbz6ngTp3QynINalfLY22/qL3buQO/ZY9WhadtjkGC+9EglwJKpA==&6l=sHbLpdw8x0Nx4 HTTP/1.1Host: www.curvygirlholiday.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /maw9/?AVF=CxDYGZqaFGf+wggxXYaRsXxHYh0vkMvLuxQU/eiz8BKY71rUvugXdjEA5Q+gRIVecMz1lX5ZhQ==&6l=sHbLpdw8x0Nx4 HTTP/1.1Host: www.networkingmaderas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.dinkoistmatrimony.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/htmlTransfer-Encoding: chunkedDate: Mon, 03 May 2021 12:53:52 GMTServer: LiteSpeedData Raw: 32 38 37 32 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43
Source: ipconfig.exe, 00000017.00000002.598011304.0000000003162000.00000004.00000001.sdmp String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: powershell.exe, 00000002.00000002.526394287.0000000002FEF000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: powershell.exe, 00000002.00000002.529584600.00000000049DE000.00000004.00000001.sdmp, powershell.exe, 00000004.00000003.464881292.0000000008023000.00000004.00000001.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp, powershell.exe, 00000002.00000002.527445795.00000000048A1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000002.00000002.529584600.00000000049DE000.00000004.00000001.sdmp, powershell.exe, 00000004.00000003.464881292.0000000008023000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 0000000B.00000002.594031738.000000000095C000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 0000000B.00000000.417611196.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: powershell.exe, 00000002.00000002.529584600.00000000049DE000.00000004.00000001.sdmp, powershell.exe, 00000004.00000003.464881292.0000000008023000.00000004.00000001.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: HAWB AND INV.exe String found in binary or memory: https://github.com/unguest
Source: HAWB AND INV.exe String found in binary or memory: https://github.com/unguest9WinForms_RecursiveFormCreate5WinForms_SeeInnerExceptionGProperty
Source: ipconfig.exe, 00000017.00000002.598011304.0000000003162000.00000004.00000001.sdmp String found in binary or memory: https://go.cpanel.net/privacy
Source: powershell.exe, 00000004.00000003.477109333.0000000005AE1000.00000004.00000001.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000003.453197763.0000000005250000.00000004.00000001.sdmp String found in binary or memory: https://go.microX%
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 0000000A.00000002.473823367.0000000000C50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.593665337.0000000000880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.470161659.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.482267255.00000000014E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.591815076.0000000000110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.350474951.0000000003CE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.593621716.0000000000850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 10.2.HAWB AND INV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.HAWB AND INV.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HAWB AND INV.exe.3d81880.3.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 0000000A.00000002.473823367.0000000000C50000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.473823367.0000000000C50000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.593665337.0000000000880000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.593665337.0000000000880000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.470161659.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.470161659.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.482267255.00000000014E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.482267255.00000000014E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.591815076.0000000000110000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.591815076.0000000000110000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.350474951.0000000003CE9000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.350474951.0000000003CE9000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 10.2.HAWB AND INV.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 10.2.HAWB AND INV.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 10.2.HAWB AND INV.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 10.2.HAWB AND INV.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.HAWB AND INV.exe.3d81880.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.HAWB AND INV.exe.3d81880.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_004181B0 NtCreateFile, 10_2_004181B0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_00418260 NtReadFile, 10_2_00418260
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_004182E0 NtClose, 10_2_004182E0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_00418390 NtAllocateVirtualMemory, 10_2_00418390
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_004181AA NtCreateFile, 10_2_004181AA
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041825A NtReadFile, 10_2_0041825A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219910 NtAdjustPrivilegesToken,LdrInitializeThunk, 10_2_01219910
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012199A0 NtCreateSection,LdrInitializeThunk, 10_2_012199A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219860 NtQuerySystemInformation,LdrInitializeThunk, 10_2_01219860
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219840 NtDelayExecution,LdrInitializeThunk, 10_2_01219840
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012198F0 NtReadVirtualMemory,LdrInitializeThunk, 10_2_012198F0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219A20 NtResumeThread,LdrInitializeThunk, 10_2_01219A20
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219A00 NtProtectVirtualMemory,LdrInitializeThunk, 10_2_01219A00
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219A50 NtCreateFile,LdrInitializeThunk, 10_2_01219A50
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219540 NtReadFile,LdrInitializeThunk, 10_2_01219540
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012195D0 NtClose,LdrInitializeThunk, 10_2_012195D0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219710 NtQueryInformationToken,LdrInitializeThunk, 10_2_01219710
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012197A0 NtUnmapViewOfSection,LdrInitializeThunk, 10_2_012197A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219780 NtMapViewOfSection,LdrInitializeThunk, 10_2_01219780
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219FE0 NtCreateMutant,LdrInitializeThunk, 10_2_01219FE0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219660 NtAllocateVirtualMemory,LdrInitializeThunk, 10_2_01219660
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012196E0 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_012196E0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219950 NtQueueApcThread, 10_2_01219950
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012199D0 NtCreateProcessEx, 10_2_012199D0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219820 NtEnumerateKey, 10_2_01219820
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0121B040 NtSuspendThread, 10_2_0121B040
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012198A0 NtWriteVirtualMemory, 10_2_012198A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219B00 NtSetValueKey, 10_2_01219B00
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0121A3B0 NtGetContextThread, 10_2_0121A3B0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219A10 NtQuerySection, 10_2_01219A10
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219A80 NtOpenDirectoryObject, 10_2_01219A80
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219520 NtWaitForSingleObject, 10_2_01219520
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0121AD30 NtSetContextThread, 10_2_0121AD30
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219560 NtWriteFile, 10_2_01219560
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012195F0 NtQueryInformationFile, 10_2_012195F0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219730 NtQueryVirtualMemory, 10_2_01219730
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0121A710 NtOpenProcessToken, 10_2_0121A710
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219760 NtOpenProcess, 10_2_01219760
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0121A770 NtOpenThread, 10_2_0121A770
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219770 NtSetInformationFile, 10_2_01219770
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219610 NtEnumerateValueKey, 10_2_01219610
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219670 NtQueryInformationProcess, 10_2_01219670
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01219650 NtQueryValueKey, 10_2_01219650
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012196D0 NtCreateKey, 10_2_012196D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19A50 NtCreateFile,LdrInitializeThunk, 23_2_02B19A50
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19860 NtQuerySystemInformation,LdrInitializeThunk, 23_2_02B19860
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19840 NtDelayExecution,LdrInitializeThunk, 23_2_02B19840
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B199A0 NtCreateSection,LdrInitializeThunk, 23_2_02B199A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19910 NtAdjustPrivilegesToken,LdrInitializeThunk, 23_2_02B19910
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B196E0 NtFreeVirtualMemory,LdrInitializeThunk, 23_2_02B196E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B196D0 NtCreateKey,LdrInitializeThunk, 23_2_02B196D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19780 NtMapViewOfSection,LdrInitializeThunk, 23_2_02B19780
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19FE0 NtCreateMutant,LdrInitializeThunk, 23_2_02B19FE0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19710 NtQueryInformationToken,LdrInitializeThunk, 23_2_02B19710
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B195D0 NtClose,LdrInitializeThunk, 23_2_02B195D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19540 NtReadFile,LdrInitializeThunk, 23_2_02B19540
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19A80 NtOpenDirectoryObject, 23_2_02B19A80
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19A20 NtResumeThread, 23_2_02B19A20
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19A10 NtQuerySection, 23_2_02B19A10
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19A00 NtProtectVirtualMemory, 23_2_02B19A00
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B1A3B0 NtGetContextThread, 23_2_02B1A3B0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19B00 NtSetValueKey, 23_2_02B19B00
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B198A0 NtWriteVirtualMemory, 23_2_02B198A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B198F0 NtReadVirtualMemory, 23_2_02B198F0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19820 NtEnumerateKey, 23_2_02B19820
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B1B040 NtSuspendThread, 23_2_02B1B040
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B199D0 NtCreateProcessEx, 23_2_02B199D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19950 NtQueueApcThread, 23_2_02B19950
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19610 NtEnumerateValueKey, 23_2_02B19610
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19670 NtQueryInformationProcess, 23_2_02B19670
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19660 NtAllocateVirtualMemory, 23_2_02B19660
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19650 NtQueryValueKey, 23_2_02B19650
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B197A0 NtUnmapViewOfSection, 23_2_02B197A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19730 NtQueryVirtualMemory, 23_2_02B19730
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B1A710 NtOpenProcessToken, 23_2_02B1A710
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B1A770 NtOpenThread, 23_2_02B1A770
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19770 NtSetInformationFile, 23_2_02B19770
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19760 NtOpenProcess, 23_2_02B19760
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B195F0 NtQueryInformationFile, 23_2_02B195F0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B1AD30 NtSetContextThread, 23_2_02B1AD30
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19520 NtWaitForSingleObject, 23_2_02B19520
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B19560 NtWriteFile, 23_2_02B19560
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_001281B0 NtCreateFile, 23_2_001281B0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_00128260 NtReadFile, 23_2_00128260
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_001282E0 NtClose, 23_2_001282E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_001281AA NtCreateFile, 23_2_001281AA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_0012825A NtReadFile, 23_2_0012825A
Detected potential crypto function
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_012AC3A0 0_2_012AC3A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_012AA758 0_2_012AA758
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_012AF838 0_2_012AF838
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_058320B0 0_2_058320B0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_058320C0 0_2_058320C0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_05831038 0_2_05831038
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_05831D98 0_2_05831D98
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_05831DF0 0_2_05831DF0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_05830FF4 0_2_05830FF4
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_05833F41 0_2_05833F41
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_05833F50 0_2_05833F50
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_05831911 0_2_05831911
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_05831920 0_2_05831920
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_05836A18 0_2_05836A18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_02E8E750 2_2_02E8E750
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041C84F 10_2_0041C84F
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_00401026 10_2_00401026
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_00401030 10_2_00401030
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041C1F0 10_2_0041C1F0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_00408C50 10_2_00408C50
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041BC3A 10_2_0041BC3A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041CD1A 10_2_0041CD1A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041C5F3 10_2_0041C5F3
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041B584 10_2_0041B584
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_00402D88 10_2_00402D88
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_00402D90 10_2_00402D90
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041CE7B 10_2_0041CE7B
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041BE26 10_2_0041BE26
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041C7D9 10_2_0041C7D9
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_00402FB0 10_2_00402FB0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DF900 10_2_011DF900
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011F4120 10_2_011F4120
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291002 10_2_01291002
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012020A0 10_2_012020A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A20A8 10_2_012A20A8
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011EB090 10_2_011EB090
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A28EC 10_2_012A28EC
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A2B28 10_2_012A2B28
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120EBB0 10_2_0120EBB0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129DBD2 10_2_0129DBD2
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A22AE 10_2_012A22AE
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A2D07 10_2_012A2D07
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D0D20 10_2_011D0D20
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A1D55 10_2_012A1D55
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01202581 10_2_01202581
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A25DD 10_2_012A25DD
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011ED5E0 10_2_011ED5E0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E841F 10_2_011E841F
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129D466 10_2_0129D466
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A1FF1 10_2_012A1FF1
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011F6E30 10_2_011F6E30
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129D616 10_2_0129D616
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A2EF7 10_2_012A2EF7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA22AE 23_2_02BA22AE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0EBB0 23_2_02B0EBB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9DBD2 23_2_02B9DBD2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA2B28 23_2_02BA2B28
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B020A0 23_2_02B020A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA20A8 23_2_02BA20A8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AEB090 23_2_02AEB090
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA28EC 23_2_02BA28EC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BAE824 23_2_02BAE824
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91002 23_2_02B91002
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AF4120 23_2_02AF4120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADF900 23_2_02ADF900
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA2EF7 23_2_02BA2EF7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AF6E30 23_2_02AF6E30
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9D616 23_2_02B9D616
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA1FF1 23_2_02BA1FF1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE841F 23_2_02AE841F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9D466 23_2_02B9D466
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B02581 23_2_02B02581
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AED5E0 23_2_02AED5E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA25DD 23_2_02BA25DD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD0D20 23_2_02AD0D20
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA2D07 23_2_02BA2D07
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA1D55 23_2_02BA1D55
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_0012C84F 23_2_0012C84F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_0012BC3A 23_2_0012BC3A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_00118C50 23_2_00118C50
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_00112D90 23_2_00112D90
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_0012B584 23_2_0012B584
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_00112D88 23_2_00112D88
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_0012C5F3 23_2_0012C5F3
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_00112FB0 23_2_00112FB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_0012C7D9 23_2_0012C7D9
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 02ADB150 appears 35 times
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: String function: 011DB150 appears 35 times
Sample file is different than original file name gathered from version info
Source: HAWB AND INV.exe Binary or memory string: OriginalFilename vs HAWB AND INV.exe
Source: HAWB AND INV.exe, 00000000.00000002.364582224.000000000BE40000.00000002.00000001.sdmp Binary or memory string: originalfilename vs HAWB AND INV.exe
Source: HAWB AND INV.exe, 00000000.00000002.364582224.000000000BE40000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs HAWB AND INV.exe
Source: HAWB AND INV.exe, 00000000.00000002.363402350.00000000060D0000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll@ vs HAWB AND INV.exe
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSimpleUI.dll( vs HAWB AND INV.exe
Source: HAWB AND INV.exe, 00000000.00000002.363989831.000000000BD40000.00000002.00000001.sdmp Binary or memory string: System.OriginalFileName vs HAWB AND INV.exe
Source: HAWB AND INV.exe Binary or memory string: OriginalFilename vs HAWB AND INV.exe
Source: HAWB AND INV.exe, 0000000A.00000002.485481654.0000000003107000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameipconfig.exej% vs HAWB AND INV.exe
Source: HAWB AND INV.exe, 0000000A.00000002.479054770.00000000012CF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs HAWB AND INV.exe
Source: HAWB AND INV.exe Binary or memory string: OriginalFilenameTOKENPRIMARYGROUP.exe6 vs HAWB AND INV.exe
Uses 32bit PE files
Source: HAWB AND INV.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 0000000A.00000002.473823367.0000000000C50000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.473823367.0000000000C50000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.593665337.0000000000880000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.593665337.0000000000880000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.470161659.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.470161659.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.482267255.00000000014E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.482267255.00000000014E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.591815076.0000000000110000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.591815076.0000000000110000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.350474951.0000000003CE9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.350474951.0000000003CE9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 10.2.HAWB AND INV.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 10.2.HAWB AND INV.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 10.2.HAWB AND INV.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 10.2.HAWB AND INV.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.HAWB AND INV.exe.3d81880.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.HAWB AND INV.exe.3d81880.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: HAWB AND INV.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: qxnptkmQbHB.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@16/19@9/4
Source: C:\Users\user\Desktop\HAWB AND INV.exe File created: C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6948:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4756:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7080:120:WilError_01
Source: C:\Users\user\Desktop\HAWB AND INV.exe File created: C:\Users\user\AppData\Local\Temp\tmp9D41.tmp Jump to behavior
Source: HAWB AND INV.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\HAWB AND INV.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\HAWB AND INV.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
Source: HAWB AND INV.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\Desktop\HAWB AND INV.exe File read: C:\Users\user\Desktop\HAWB AND INV.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\HAWB AND INV.exe 'C:\Users\user\Desktop\HAWB AND INV.exe'
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HAWB AND INV.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\qxnptkmQbHB' /XML 'C:\Users\user\AppData\Local\Temp\tmp9D41.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Users\user\Desktop\HAWB AND INV.exe C:\Users\user\Desktop\HAWB AND INV.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HAWB AND INV.exe' Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe' Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\qxnptkmQbHB' /XML 'C:\Users\user\AppData\Local\Temp\tmp9D41.tmp' Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe' Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Users\user\Desktop\HAWB AND INV.exe C:\Users\user\Desktop\HAWB AND INV.exe Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: HAWB AND INV.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: HAWB AND INV.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: ipconfig.pdb source: HAWB AND INV.exe, 0000000A.00000002.485361222.0000000003100000.00000040.00000001.sdmp
Source: Binary string: ipconfig.pdbGCTL source: HAWB AND INV.exe, 0000000A.00000002.485361222.0000000003100000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 0000000B.00000000.426929861.000000000DC20000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: HAWB AND INV.exe, 0000000A.00000002.479054770.00000000012CF000.00000040.00000001.sdmp, ipconfig.exe, 00000017.00000003.473141653.00000000008F0000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: HAWB AND INV.exe, ipconfig.exe
Source: Binary string: wscui.pdb source: explorer.exe, 0000000B.00000000.426929861.000000000DC20000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_009794E5 push cs; iretd 0_2_009794E6
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_05838AB8 pushad ; ret 0_2_05838ABC
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_05838AC2 pushad ; ret 0_2_05838AC3
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041B3B5 push eax; ret 10_2_0041B408
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041B46C push eax; ret 10_2_0041B472
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041B402 push eax; ret 10_2_0041B408
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041B40B push eax; ret 10_2_0041B472
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0041B584 push edi; ret 10_2_0041BBBA
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_00415611 pushfd ; iretd 10_2_00415612
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_00415EB3 push edx; retf 10_2_00415ECE
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_00415FB3 push esi; ret 10_2_00415FBA
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_007594E5 push cs; iretd 10_2_007594E6
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0122D0D1 push ecx; ret 10_2_0122D0E4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B2D0D1 push ecx; ret 23_2_02B2D0E4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_0012B3B5 push eax; ret 23_2_0012B408
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_0012B402 push eax; ret 23_2_0012B408
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_0012B40B push eax; ret 23_2_0012B472
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_0012B46C push eax; ret 23_2_0012B472
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_0012B584 push edi; ret 23_2_0012BBBA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_00125611 pushfd ; iretd 23_2_00125612
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_00125EB3 push edx; retf 23_2_00125ECE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_00125FB3 push esi; ret 23_2_00125FBA
Source: initial sample Static PE information: section name: .text entropy: 7.93407065965
Source: initial sample Static PE information: section name: .text entropy: 7.93407065965

Persistence and Installation Behavior:

barindex
Uses ipconfig to lookup or modify the Windows network settings
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Drops PE files
Source: C:\Users\user\Desktop\HAWB AND INV.exe File created: C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\qxnptkmQbHB' /XML 'C:\Users\user\AppData\Local\Temp\tmp9D41.tmp'

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\ipconfig.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: HAWB AND INV.exe PID: 6752, type: MEMORY
Source: Yara match File source: 0.2.HAWB AND INV.exe.2d0f5ac.1.raw.unpack, type: UNPACKEDPE
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\HAWB AND INV.exe WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\HAWB AND INV.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\HAWB AND INV.exe RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe RDTSC instruction interceptor: First address: 00000000001185E4 second address: 00000000001185EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe RDTSC instruction interceptor: First address: 000000000011896E second address: 0000000000118974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\HAWB AND INV.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0 Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_004088A0 rdtsc 10_2_004088A0
Contains functionality to detect virtual machines (SLDT)
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 0_2_009745A8 sldt word ptr [eax] 0_2_009745A8
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\HAWB AND INV.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4137 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3031 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4167 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2752 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4731
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1801
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\HAWB AND INV.exe TID: 6756 Thread sleep time: -101846s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe TID: 6796 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6844 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6160 Thread sleep count: 4167 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6160 Thread sleep count: 2752 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4532 Thread sleep count: 43 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5536 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5940 Thread sleep count: 4731 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5940 Thread sleep count: 1801 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5688 Thread sleep count: 47 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6876 Thread sleep time: -22136092888451448s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\ipconfig.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\HAWB AND INV.exe Thread delayed: delay time: 101846 Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: powershell.exe, 00000004.00000003.475227153.00000000059ED000.00000004.00000001.sdmp, powershell.exe, 00000008.00000003.539404811.0000000005332000.00000004.00000001.sdmp Binary or memory string: Hyper-V
Source: explorer.exe, 0000000B.00000000.410165765.00000000083EB000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 0000000B.00000000.410406652.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000000B.00000000.390572167.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 0000000B.00000002.615205318.00000000062E0000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllte
Source: explorer.exe, 0000000B.00000000.396565510.00000000063F6000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 0000000B.00000000.390572167.0000000005D50000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 0000000B.00000000.396565510.00000000063F6000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: vmware
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 0000000B.00000000.410165765.00000000083EB000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: explorer.exe, 0000000B.00000000.407965163.00000000082E2000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 0000000B.00000000.390572167.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 0000000B.00000000.407965163.00000000082E2000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: HAWB AND INV.exe, 00000000.00000002.347517443.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 0000000B.00000000.410406652.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: powershell.exe, 00000004.00000003.475227153.00000000059ED000.00000004.00000001.sdmp, powershell.exe, 00000008.00000003.539404811.0000000005332000.00000004.00000001.sdmp Binary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: explorer.exe, 0000000B.00000000.390572167.0000000005D50000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: explorer.exe, 0000000B.00000002.594031738.000000000095C000.00000004.00000020.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process queried: DebugPort
Source: C:\Windows\SysWOW64\ipconfig.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_004088A0 rdtsc 10_2_004088A0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_00409B10 LdrLoadDll, 10_2_00409B10
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120513A mov eax, dword ptr fs:[00000030h] 10_2_0120513A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120513A mov eax, dword ptr fs:[00000030h] 10_2_0120513A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D9100 mov eax, dword ptr fs:[00000030h] 10_2_011D9100
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D9100 mov eax, dword ptr fs:[00000030h] 10_2_011D9100
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D9100 mov eax, dword ptr fs:[00000030h] 10_2_011D9100
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011F4120 mov eax, dword ptr fs:[00000030h] 10_2_011F4120
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011F4120 mov eax, dword ptr fs:[00000030h] 10_2_011F4120
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011F4120 mov eax, dword ptr fs:[00000030h] 10_2_011F4120
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011F4120 mov eax, dword ptr fs:[00000030h] 10_2_011F4120
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011F4120 mov ecx, dword ptr fs:[00000030h] 10_2_011F4120
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011FB944 mov eax, dword ptr fs:[00000030h] 10_2_011FB944
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011FB944 mov eax, dword ptr fs:[00000030h] 10_2_011FB944
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DB171 mov eax, dword ptr fs:[00000030h] 10_2_011DB171
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DB171 mov eax, dword ptr fs:[00000030h] 10_2_011DB171
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DC962 mov eax, dword ptr fs:[00000030h] 10_2_011DC962
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012061A0 mov eax, dword ptr fs:[00000030h] 10_2_012061A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012061A0 mov eax, dword ptr fs:[00000030h] 10_2_012061A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012569A6 mov eax, dword ptr fs:[00000030h] 10_2_012569A6
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012551BE mov eax, dword ptr fs:[00000030h] 10_2_012551BE
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012551BE mov eax, dword ptr fs:[00000030h] 10_2_012551BE
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012551BE mov eax, dword ptr fs:[00000030h] 10_2_012551BE
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012551BE mov eax, dword ptr fs:[00000030h] 10_2_012551BE
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011FC182 mov eax, dword ptr fs:[00000030h] 10_2_011FC182
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120A185 mov eax, dword ptr fs:[00000030h] 10_2_0120A185
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01202990 mov eax, dword ptr fs:[00000030h] 10_2_01202990
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012641E8 mov eax, dword ptr fs:[00000030h] 10_2_012641E8
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DB1E1 mov eax, dword ptr fs:[00000030h] 10_2_011DB1E1
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DB1E1 mov eax, dword ptr fs:[00000030h] 10_2_011DB1E1
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DB1E1 mov eax, dword ptr fs:[00000030h] 10_2_011DB1E1
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120002D mov eax, dword ptr fs:[00000030h] 10_2_0120002D
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120002D mov eax, dword ptr fs:[00000030h] 10_2_0120002D
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120002D mov eax, dword ptr fs:[00000030h] 10_2_0120002D
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120002D mov eax, dword ptr fs:[00000030h] 10_2_0120002D
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120002D mov eax, dword ptr fs:[00000030h] 10_2_0120002D
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01257016 mov eax, dword ptr fs:[00000030h] 10_2_01257016
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01257016 mov eax, dword ptr fs:[00000030h] 10_2_01257016
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01257016 mov eax, dword ptr fs:[00000030h] 10_2_01257016
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011EB02A mov eax, dword ptr fs:[00000030h] 10_2_011EB02A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011EB02A mov eax, dword ptr fs:[00000030h] 10_2_011EB02A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011EB02A mov eax, dword ptr fs:[00000030h] 10_2_011EB02A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011EB02A mov eax, dword ptr fs:[00000030h] 10_2_011EB02A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A4015 mov eax, dword ptr fs:[00000030h] 10_2_012A4015
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A4015 mov eax, dword ptr fs:[00000030h] 10_2_012A4015
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011F0050 mov eax, dword ptr fs:[00000030h] 10_2_011F0050
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011F0050 mov eax, dword ptr fs:[00000030h] 10_2_011F0050
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01292073 mov eax, dword ptr fs:[00000030h] 10_2_01292073
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A1074 mov eax, dword ptr fs:[00000030h] 10_2_012A1074
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012020A0 mov eax, dword ptr fs:[00000030h] 10_2_012020A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012020A0 mov eax, dword ptr fs:[00000030h] 10_2_012020A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012020A0 mov eax, dword ptr fs:[00000030h] 10_2_012020A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012020A0 mov eax, dword ptr fs:[00000030h] 10_2_012020A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012020A0 mov eax, dword ptr fs:[00000030h] 10_2_012020A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012020A0 mov eax, dword ptr fs:[00000030h] 10_2_012020A0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012190AF mov eax, dword ptr fs:[00000030h] 10_2_012190AF
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D9080 mov eax, dword ptr fs:[00000030h] 10_2_011D9080
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120F0BF mov ecx, dword ptr fs:[00000030h] 10_2_0120F0BF
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120F0BF mov eax, dword ptr fs:[00000030h] 10_2_0120F0BF
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120F0BF mov eax, dword ptr fs:[00000030h] 10_2_0120F0BF
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01253884 mov eax, dword ptr fs:[00000030h] 10_2_01253884
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01253884 mov eax, dword ptr fs:[00000030h] 10_2_01253884
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D58EC mov eax, dword ptr fs:[00000030h] 10_2_011D58EC
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0126B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0126B8D0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0126B8D0 mov ecx, dword ptr fs:[00000030h] 10_2_0126B8D0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0126B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0126B8D0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0126B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0126B8D0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0126B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0126B8D0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0126B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0126B8D0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129131B mov eax, dword ptr fs:[00000030h] 10_2_0129131B
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DF358 mov eax, dword ptr fs:[00000030h] 10_2_011DF358
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01203B7A mov eax, dword ptr fs:[00000030h] 10_2_01203B7A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01203B7A mov eax, dword ptr fs:[00000030h] 10_2_01203B7A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DDB40 mov eax, dword ptr fs:[00000030h] 10_2_011DDB40
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A8B58 mov eax, dword ptr fs:[00000030h] 10_2_012A8B58
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DDB60 mov ecx, dword ptr fs:[00000030h] 10_2_011DDB60
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01204BAD mov eax, dword ptr fs:[00000030h] 10_2_01204BAD
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01204BAD mov eax, dword ptr fs:[00000030h] 10_2_01204BAD
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01204BAD mov eax, dword ptr fs:[00000030h] 10_2_01204BAD
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A5BA5 mov eax, dword ptr fs:[00000030h] 10_2_012A5BA5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E1B8F mov eax, dword ptr fs:[00000030h] 10_2_011E1B8F
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E1B8F mov eax, dword ptr fs:[00000030h] 10_2_011E1B8F
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129138A mov eax, dword ptr fs:[00000030h] 10_2_0129138A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0128D380 mov ecx, dword ptr fs:[00000030h] 10_2_0128D380
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120B390 mov eax, dword ptr fs:[00000030h] 10_2_0120B390
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01202397 mov eax, dword ptr fs:[00000030h] 10_2_01202397
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012003E2 mov eax, dword ptr fs:[00000030h] 10_2_012003E2
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012003E2 mov eax, dword ptr fs:[00000030h] 10_2_012003E2
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012003E2 mov eax, dword ptr fs:[00000030h] 10_2_012003E2
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012003E2 mov eax, dword ptr fs:[00000030h] 10_2_012003E2
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012003E2 mov eax, dword ptr fs:[00000030h] 10_2_012003E2
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012003E2 mov eax, dword ptr fs:[00000030h] 10_2_012003E2
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012553CA mov eax, dword ptr fs:[00000030h] 10_2_012553CA
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012553CA mov eax, dword ptr fs:[00000030h] 10_2_012553CA
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011FDBE9 mov eax, dword ptr fs:[00000030h] 10_2_011FDBE9
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011F3A1C mov eax, dword ptr fs:[00000030h] 10_2_011F3A1C
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DAA16 mov eax, dword ptr fs:[00000030h] 10_2_011DAA16
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DAA16 mov eax, dword ptr fs:[00000030h] 10_2_011DAA16
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01214A2C mov eax, dword ptr fs:[00000030h] 10_2_01214A2C
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01214A2C mov eax, dword ptr fs:[00000030h] 10_2_01214A2C
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D5210 mov eax, dword ptr fs:[00000030h] 10_2_011D5210
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D5210 mov ecx, dword ptr fs:[00000030h] 10_2_011D5210
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D5210 mov eax, dword ptr fs:[00000030h] 10_2_011D5210
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D5210 mov eax, dword ptr fs:[00000030h] 10_2_011D5210
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E8A0A mov eax, dword ptr fs:[00000030h] 10_2_011E8A0A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129AA16 mov eax, dword ptr fs:[00000030h] 10_2_0129AA16
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129AA16 mov eax, dword ptr fs:[00000030h] 10_2_0129AA16
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0128B260 mov eax, dword ptr fs:[00000030h] 10_2_0128B260
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0128B260 mov eax, dword ptr fs:[00000030h] 10_2_0128B260
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A8A62 mov eax, dword ptr fs:[00000030h] 10_2_012A8A62
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0121927A mov eax, dword ptr fs:[00000030h] 10_2_0121927A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D9240 mov eax, dword ptr fs:[00000030h] 10_2_011D9240
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D9240 mov eax, dword ptr fs:[00000030h] 10_2_011D9240
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D9240 mov eax, dword ptr fs:[00000030h] 10_2_011D9240
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D9240 mov eax, dword ptr fs:[00000030h] 10_2_011D9240
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01264257 mov eax, dword ptr fs:[00000030h] 10_2_01264257
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129EA55 mov eax, dword ptr fs:[00000030h] 10_2_0129EA55
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120FAB0 mov eax, dword ptr fs:[00000030h] 10_2_0120FAB0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011EAAB0 mov eax, dword ptr fs:[00000030h] 10_2_011EAAB0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011EAAB0 mov eax, dword ptr fs:[00000030h] 10_2_011EAAB0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120D294 mov eax, dword ptr fs:[00000030h] 10_2_0120D294
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120D294 mov eax, dword ptr fs:[00000030h] 10_2_0120D294
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D52A5 mov eax, dword ptr fs:[00000030h] 10_2_011D52A5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D52A5 mov eax, dword ptr fs:[00000030h] 10_2_011D52A5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D52A5 mov eax, dword ptr fs:[00000030h] 10_2_011D52A5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D52A5 mov eax, dword ptr fs:[00000030h] 10_2_011D52A5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D52A5 mov eax, dword ptr fs:[00000030h] 10_2_011D52A5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01202AE4 mov eax, dword ptr fs:[00000030h] 10_2_01202AE4
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01202ACB mov eax, dword ptr fs:[00000030h] 10_2_01202ACB
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129E539 mov eax, dword ptr fs:[00000030h] 10_2_0129E539
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0125A537 mov eax, dword ptr fs:[00000030h] 10_2_0125A537
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01204D3B mov eax, dword ptr fs:[00000030h] 10_2_01204D3B
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01204D3B mov eax, dword ptr fs:[00000030h] 10_2_01204D3B
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01204D3B mov eax, dword ptr fs:[00000030h] 10_2_01204D3B
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A8D34 mov eax, dword ptr fs:[00000030h] 10_2_012A8D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E3D34 mov eax, dword ptr fs:[00000030h] 10_2_011E3D34
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DAD30 mov eax, dword ptr fs:[00000030h] 10_2_011DAD30
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011F7D50 mov eax, dword ptr fs:[00000030h] 10_2_011F7D50
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01213D43 mov eax, dword ptr fs:[00000030h] 10_2_01213D43
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01253540 mov eax, dword ptr fs:[00000030h] 10_2_01253540
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011FC577 mov eax, dword ptr fs:[00000030h] 10_2_011FC577
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011FC577 mov eax, dword ptr fs:[00000030h] 10_2_011FC577
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012035A1 mov eax, dword ptr fs:[00000030h] 10_2_012035A1
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A05AC mov eax, dword ptr fs:[00000030h] 10_2_012A05AC
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A05AC mov eax, dword ptr fs:[00000030h] 10_2_012A05AC
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01201DB5 mov eax, dword ptr fs:[00000030h] 10_2_01201DB5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01201DB5 mov eax, dword ptr fs:[00000030h] 10_2_01201DB5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01201DB5 mov eax, dword ptr fs:[00000030h] 10_2_01201DB5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D2D8A mov eax, dword ptr fs:[00000030h] 10_2_011D2D8A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D2D8A mov eax, dword ptr fs:[00000030h] 10_2_011D2D8A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D2D8A mov eax, dword ptr fs:[00000030h] 10_2_011D2D8A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D2D8A mov eax, dword ptr fs:[00000030h] 10_2_011D2D8A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D2D8A mov eax, dword ptr fs:[00000030h] 10_2_011D2D8A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01202581 mov eax, dword ptr fs:[00000030h] 10_2_01202581
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01202581 mov eax, dword ptr fs:[00000030h] 10_2_01202581
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01202581 mov eax, dword ptr fs:[00000030h] 10_2_01202581
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01202581 mov eax, dword ptr fs:[00000030h] 10_2_01202581
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120FD9B mov eax, dword ptr fs:[00000030h] 10_2_0120FD9B
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120FD9B mov eax, dword ptr fs:[00000030h] 10_2_0120FD9B
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129FDE2 mov eax, dword ptr fs:[00000030h] 10_2_0129FDE2
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129FDE2 mov eax, dword ptr fs:[00000030h] 10_2_0129FDE2
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129FDE2 mov eax, dword ptr fs:[00000030h] 10_2_0129FDE2
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129FDE2 mov eax, dword ptr fs:[00000030h] 10_2_0129FDE2
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01288DF1 mov eax, dword ptr fs:[00000030h] 10_2_01288DF1
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256DC9 mov eax, dword ptr fs:[00000030h] 10_2_01256DC9
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256DC9 mov eax, dword ptr fs:[00000030h] 10_2_01256DC9
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256DC9 mov eax, dword ptr fs:[00000030h] 10_2_01256DC9
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256DC9 mov ecx, dword ptr fs:[00000030h] 10_2_01256DC9
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256DC9 mov eax, dword ptr fs:[00000030h] 10_2_01256DC9
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256DC9 mov eax, dword ptr fs:[00000030h] 10_2_01256DC9
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011ED5E0 mov eax, dword ptr fs:[00000030h] 10_2_011ED5E0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011ED5E0 mov eax, dword ptr fs:[00000030h] 10_2_011ED5E0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120BC2C mov eax, dword ptr fs:[00000030h] 10_2_0120BC2C
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A740D mov eax, dword ptr fs:[00000030h] 10_2_012A740D
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A740D mov eax, dword ptr fs:[00000030h] 10_2_012A740D
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A740D mov eax, dword ptr fs:[00000030h] 10_2_012A740D
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291C06 mov eax, dword ptr fs:[00000030h] 10_2_01291C06
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256C0A mov eax, dword ptr fs:[00000030h] 10_2_01256C0A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256C0A mov eax, dword ptr fs:[00000030h] 10_2_01256C0A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256C0A mov eax, dword ptr fs:[00000030h] 10_2_01256C0A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256C0A mov eax, dword ptr fs:[00000030h] 10_2_01256C0A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120A44B mov eax, dword ptr fs:[00000030h] 10_2_0120A44B
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011F746D mov eax, dword ptr fs:[00000030h] 10_2_011F746D
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0126C450 mov eax, dword ptr fs:[00000030h] 10_2_0126C450
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0126C450 mov eax, dword ptr fs:[00000030h] 10_2_0126C450
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E849B mov eax, dword ptr fs:[00000030h] 10_2_011E849B
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012914FB mov eax, dword ptr fs:[00000030h] 10_2_012914FB
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256CF0 mov eax, dword ptr fs:[00000030h] 10_2_01256CF0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256CF0 mov eax, dword ptr fs:[00000030h] 10_2_01256CF0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01256CF0 mov eax, dword ptr fs:[00000030h] 10_2_01256CF0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A8CD6 mov eax, dword ptr fs:[00000030h] 10_2_012A8CD6
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011FF716 mov eax, dword ptr fs:[00000030h] 10_2_011FF716
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120E730 mov eax, dword ptr fs:[00000030h] 10_2_0120E730
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A070D mov eax, dword ptr fs:[00000030h] 10_2_012A070D
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A070D mov eax, dword ptr fs:[00000030h] 10_2_012A070D
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120A70E mov eax, dword ptr fs:[00000030h] 10_2_0120A70E
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120A70E mov eax, dword ptr fs:[00000030h] 10_2_0120A70E
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D4F2E mov eax, dword ptr fs:[00000030h] 10_2_011D4F2E
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011D4F2E mov eax, dword ptr fs:[00000030h] 10_2_011D4F2E
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0126FF10 mov eax, dword ptr fs:[00000030h] 10_2_0126FF10
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0126FF10 mov eax, dword ptr fs:[00000030h] 10_2_0126FF10
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A8F6A mov eax, dword ptr fs:[00000030h] 10_2_012A8F6A
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011EEF40 mov eax, dword ptr fs:[00000030h] 10_2_011EEF40
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011EFF60 mov eax, dword ptr fs:[00000030h] 10_2_011EFF60
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E8794 mov eax, dword ptr fs:[00000030h] 10_2_011E8794
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01257794 mov eax, dword ptr fs:[00000030h] 10_2_01257794
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01257794 mov eax, dword ptr fs:[00000030h] 10_2_01257794
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01257794 mov eax, dword ptr fs:[00000030h] 10_2_01257794
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012137F5 mov eax, dword ptr fs:[00000030h] 10_2_012137F5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0128FE3F mov eax, dword ptr fs:[00000030h] 10_2_0128FE3F
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DC600 mov eax, dword ptr fs:[00000030h] 10_2_011DC600
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DC600 mov eax, dword ptr fs:[00000030h] 10_2_011DC600
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DC600 mov eax, dword ptr fs:[00000030h] 10_2_011DC600
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01208E00 mov eax, dword ptr fs:[00000030h] 10_2_01208E00
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01291608 mov eax, dword ptr fs:[00000030h] 10_2_01291608
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120A61C mov eax, dword ptr fs:[00000030h] 10_2_0120A61C
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0120A61C mov eax, dword ptr fs:[00000030h] 10_2_0120A61C
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011DE620 mov eax, dword ptr fs:[00000030h] 10_2_011DE620
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E7E41 mov eax, dword ptr fs:[00000030h] 10_2_011E7E41
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E7E41 mov eax, dword ptr fs:[00000030h] 10_2_011E7E41
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E7E41 mov eax, dword ptr fs:[00000030h] 10_2_011E7E41
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E7E41 mov eax, dword ptr fs:[00000030h] 10_2_011E7E41
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E7E41 mov eax, dword ptr fs:[00000030h] 10_2_011E7E41
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E7E41 mov eax, dword ptr fs:[00000030h] 10_2_011E7E41
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011FAE73 mov eax, dword ptr fs:[00000030h] 10_2_011FAE73
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011FAE73 mov eax, dword ptr fs:[00000030h] 10_2_011FAE73
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011FAE73 mov eax, dword ptr fs:[00000030h] 10_2_011FAE73
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011FAE73 mov eax, dword ptr fs:[00000030h] 10_2_011FAE73
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011FAE73 mov eax, dword ptr fs:[00000030h] 10_2_011FAE73
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129AE44 mov eax, dword ptr fs:[00000030h] 10_2_0129AE44
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0129AE44 mov eax, dword ptr fs:[00000030h] 10_2_0129AE44
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E766D mov eax, dword ptr fs:[00000030h] 10_2_011E766D
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012546A7 mov eax, dword ptr fs:[00000030h] 10_2_012546A7
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A0EA5 mov eax, dword ptr fs:[00000030h] 10_2_012A0EA5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A0EA5 mov eax, dword ptr fs:[00000030h] 10_2_012A0EA5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A0EA5 mov eax, dword ptr fs:[00000030h] 10_2_012A0EA5
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0126FE87 mov eax, dword ptr fs:[00000030h] 10_2_0126FE87
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012016E0 mov ecx, dword ptr fs:[00000030h] 10_2_012016E0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_01218EC7 mov eax, dword ptr fs:[00000030h] 10_2_01218EC7
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_0128FEC0 mov eax, dword ptr fs:[00000030h] 10_2_0128FEC0
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012036CC mov eax, dword ptr fs:[00000030h] 10_2_012036CC
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_012A8ED6 mov eax, dword ptr fs:[00000030h] 10_2_012A8ED6
Source: C:\Users\user\Desktop\HAWB AND INV.exe Code function: 10_2_011E76E2 mov eax, dword ptr fs:[00000030h] 10_2_011E76E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0FAB0 mov eax, dword ptr fs:[00000030h] 23_2_02B0FAB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD52A5 mov eax, dword ptr fs:[00000030h] 23_2_02AD52A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD52A5 mov eax, dword ptr fs:[00000030h] 23_2_02AD52A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD52A5 mov eax, dword ptr fs:[00000030h] 23_2_02AD52A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD52A5 mov eax, dword ptr fs:[00000030h] 23_2_02AD52A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD52A5 mov eax, dword ptr fs:[00000030h] 23_2_02AD52A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AEAAB0 mov eax, dword ptr fs:[00000030h] 23_2_02AEAAB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AEAAB0 mov eax, dword ptr fs:[00000030h] 23_2_02AEAAB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0D294 mov eax, dword ptr fs:[00000030h] 23_2_02B0D294
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0D294 mov eax, dword ptr fs:[00000030h] 23_2_02B0D294
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B02AE4 mov eax, dword ptr fs:[00000030h] 23_2_02B02AE4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B02ACB mov eax, dword ptr fs:[00000030h] 23_2_02B02ACB
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B14A2C mov eax, dword ptr fs:[00000030h] 23_2_02B14A2C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B14A2C mov eax, dword ptr fs:[00000030h] 23_2_02B14A2C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE8A0A mov eax, dword ptr fs:[00000030h] 23_2_02AE8A0A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9AA16 mov eax, dword ptr fs:[00000030h] 23_2_02B9AA16
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9AA16 mov eax, dword ptr fs:[00000030h] 23_2_02B9AA16
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AF3A1C mov eax, dword ptr fs:[00000030h] 23_2_02AF3A1C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADAA16 mov eax, dword ptr fs:[00000030h] 23_2_02ADAA16
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADAA16 mov eax, dword ptr fs:[00000030h] 23_2_02ADAA16
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD5210 mov eax, dword ptr fs:[00000030h] 23_2_02AD5210
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD5210 mov ecx, dword ptr fs:[00000030h] 23_2_02AD5210
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD5210 mov eax, dword ptr fs:[00000030h] 23_2_02AD5210
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD5210 mov eax, dword ptr fs:[00000030h] 23_2_02AD5210
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B1927A mov eax, dword ptr fs:[00000030h] 23_2_02B1927A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B8B260 mov eax, dword ptr fs:[00000030h] 23_2_02B8B260
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B8B260 mov eax, dword ptr fs:[00000030h] 23_2_02B8B260
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA8A62 mov eax, dword ptr fs:[00000030h] 23_2_02BA8A62
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B64257 mov eax, dword ptr fs:[00000030h] 23_2_02B64257
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9EA55 mov eax, dword ptr fs:[00000030h] 23_2_02B9EA55
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD9240 mov eax, dword ptr fs:[00000030h] 23_2_02AD9240
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD9240 mov eax, dword ptr fs:[00000030h] 23_2_02AD9240
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD9240 mov eax, dword ptr fs:[00000030h] 23_2_02AD9240
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD9240 mov eax, dword ptr fs:[00000030h] 23_2_02AD9240
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B04BAD mov eax, dword ptr fs:[00000030h] 23_2_02B04BAD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B04BAD mov eax, dword ptr fs:[00000030h] 23_2_02B04BAD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B04BAD mov eax, dword ptr fs:[00000030h] 23_2_02B04BAD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA5BA5 mov eax, dword ptr fs:[00000030h] 23_2_02BA5BA5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0B390 mov eax, dword ptr fs:[00000030h] 23_2_02B0B390
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE1B8F mov eax, dword ptr fs:[00000030h] 23_2_02AE1B8F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE1B8F mov eax, dword ptr fs:[00000030h] 23_2_02AE1B8F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B02397 mov eax, dword ptr fs:[00000030h] 23_2_02B02397
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9138A mov eax, dword ptr fs:[00000030h] 23_2_02B9138A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B8D380 mov ecx, dword ptr fs:[00000030h] 23_2_02B8D380
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AFDBE9 mov eax, dword ptr fs:[00000030h] 23_2_02AFDBE9
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B003E2 mov eax, dword ptr fs:[00000030h] 23_2_02B003E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B003E2 mov eax, dword ptr fs:[00000030h] 23_2_02B003E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B003E2 mov eax, dword ptr fs:[00000030h] 23_2_02B003E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B003E2 mov eax, dword ptr fs:[00000030h] 23_2_02B003E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B003E2 mov eax, dword ptr fs:[00000030h] 23_2_02B003E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B003E2 mov eax, dword ptr fs:[00000030h] 23_2_02B003E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B553CA mov eax, dword ptr fs:[00000030h] 23_2_02B553CA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B553CA mov eax, dword ptr fs:[00000030h] 23_2_02B553CA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9131B mov eax, dword ptr fs:[00000030h] 23_2_02B9131B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B03B7A mov eax, dword ptr fs:[00000030h] 23_2_02B03B7A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B03B7A mov eax, dword ptr fs:[00000030h] 23_2_02B03B7A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADDB60 mov ecx, dword ptr fs:[00000030h] 23_2_02ADDB60
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA8B58 mov eax, dword ptr fs:[00000030h] 23_2_02BA8B58
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADDB40 mov eax, dword ptr fs:[00000030h] 23_2_02ADDB40
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADF358 mov eax, dword ptr fs:[00000030h] 23_2_02ADF358
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0F0BF mov ecx, dword ptr fs:[00000030h] 23_2_02B0F0BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0F0BF mov eax, dword ptr fs:[00000030h] 23_2_02B0F0BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0F0BF mov eax, dword ptr fs:[00000030h] 23_2_02B0F0BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B020A0 mov eax, dword ptr fs:[00000030h] 23_2_02B020A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B020A0 mov eax, dword ptr fs:[00000030h] 23_2_02B020A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B020A0 mov eax, dword ptr fs:[00000030h] 23_2_02B020A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B020A0 mov eax, dword ptr fs:[00000030h] 23_2_02B020A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B020A0 mov eax, dword ptr fs:[00000030h] 23_2_02B020A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B020A0 mov eax, dword ptr fs:[00000030h] 23_2_02B020A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B190AF mov eax, dword ptr fs:[00000030h] 23_2_02B190AF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD9080 mov eax, dword ptr fs:[00000030h] 23_2_02AD9080
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B53884 mov eax, dword ptr fs:[00000030h] 23_2_02B53884
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B53884 mov eax, dword ptr fs:[00000030h] 23_2_02B53884
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD58EC mov eax, dword ptr fs:[00000030h] 23_2_02AD58EC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B6B8D0 mov eax, dword ptr fs:[00000030h] 23_2_02B6B8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B6B8D0 mov ecx, dword ptr fs:[00000030h] 23_2_02B6B8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B6B8D0 mov eax, dword ptr fs:[00000030h] 23_2_02B6B8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B6B8D0 mov eax, dword ptr fs:[00000030h] 23_2_02B6B8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B6B8D0 mov eax, dword ptr fs:[00000030h] 23_2_02B6B8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B6B8D0 mov eax, dword ptr fs:[00000030h] 23_2_02B6B8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AEB02A mov eax, dword ptr fs:[00000030h] 23_2_02AEB02A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AEB02A mov eax, dword ptr fs:[00000030h] 23_2_02AEB02A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AEB02A mov eax, dword ptr fs:[00000030h] 23_2_02AEB02A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AEB02A mov eax, dword ptr fs:[00000030h] 23_2_02AEB02A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0002D mov eax, dword ptr fs:[00000030h] 23_2_02B0002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0002D mov eax, dword ptr fs:[00000030h] 23_2_02B0002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0002D mov eax, dword ptr fs:[00000030h] 23_2_02B0002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0002D mov eax, dword ptr fs:[00000030h] 23_2_02B0002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0002D mov eax, dword ptr fs:[00000030h] 23_2_02B0002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B57016 mov eax, dword ptr fs:[00000030h] 23_2_02B57016
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B57016 mov eax, dword ptr fs:[00000030h] 23_2_02B57016
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B57016 mov eax, dword ptr fs:[00000030h] 23_2_02B57016
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA4015 mov eax, dword ptr fs:[00000030h] 23_2_02BA4015
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA4015 mov eax, dword ptr fs:[00000030h] 23_2_02BA4015
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B92073 mov eax, dword ptr fs:[00000030h] 23_2_02B92073
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA1074 mov eax, dword ptr fs:[00000030h] 23_2_02BA1074
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AF0050 mov eax, dword ptr fs:[00000030h] 23_2_02AF0050
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AF0050 mov eax, dword ptr fs:[00000030h] 23_2_02AF0050
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B551BE mov eax, dword ptr fs:[00000030h] 23_2_02B551BE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B551BE mov eax, dword ptr fs:[00000030h] 23_2_02B551BE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B551BE mov eax, dword ptr fs:[00000030h] 23_2_02B551BE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B551BE mov eax, dword ptr fs:[00000030h] 23_2_02B551BE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B061A0 mov eax, dword ptr fs:[00000030h] 23_2_02B061A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B061A0 mov eax, dword ptr fs:[00000030h] 23_2_02B061A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B569A6 mov eax, dword ptr fs:[00000030h] 23_2_02B569A6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B02990 mov eax, dword ptr fs:[00000030h] 23_2_02B02990
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AFC182 mov eax, dword ptr fs:[00000030h] 23_2_02AFC182
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0A185 mov eax, dword ptr fs:[00000030h] 23_2_02B0A185
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADB1E1 mov eax, dword ptr fs:[00000030h] 23_2_02ADB1E1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADB1E1 mov eax, dword ptr fs:[00000030h] 23_2_02ADB1E1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADB1E1 mov eax, dword ptr fs:[00000030h] 23_2_02ADB1E1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B641E8 mov eax, dword ptr fs:[00000030h] 23_2_02B641E8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0513A mov eax, dword ptr fs:[00000030h] 23_2_02B0513A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0513A mov eax, dword ptr fs:[00000030h] 23_2_02B0513A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AF4120 mov eax, dword ptr fs:[00000030h] 23_2_02AF4120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AF4120 mov eax, dword ptr fs:[00000030h] 23_2_02AF4120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AF4120 mov eax, dword ptr fs:[00000030h] 23_2_02AF4120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AF4120 mov eax, dword ptr fs:[00000030h] 23_2_02AF4120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AF4120 mov ecx, dword ptr fs:[00000030h] 23_2_02AF4120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD9100 mov eax, dword ptr fs:[00000030h] 23_2_02AD9100
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD9100 mov eax, dword ptr fs:[00000030h] 23_2_02AD9100
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD9100 mov eax, dword ptr fs:[00000030h] 23_2_02AD9100
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADC962 mov eax, dword ptr fs:[00000030h] 23_2_02ADC962
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADB171 mov eax, dword ptr fs:[00000030h] 23_2_02ADB171
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADB171 mov eax, dword ptr fs:[00000030h] 23_2_02ADB171
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AFB944 mov eax, dword ptr fs:[00000030h] 23_2_02AFB944
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AFB944 mov eax, dword ptr fs:[00000030h] 23_2_02AFB944
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B546A7 mov eax, dword ptr fs:[00000030h] 23_2_02B546A7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA0EA5 mov eax, dword ptr fs:[00000030h] 23_2_02BA0EA5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA0EA5 mov eax, dword ptr fs:[00000030h] 23_2_02BA0EA5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA0EA5 mov eax, dword ptr fs:[00000030h] 23_2_02BA0EA5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B6FE87 mov eax, dword ptr fs:[00000030h] 23_2_02B6FE87
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE76E2 mov eax, dword ptr fs:[00000030h] 23_2_02AE76E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B016E0 mov ecx, dword ptr fs:[00000030h] 23_2_02B016E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA8ED6 mov eax, dword ptr fs:[00000030h] 23_2_02BA8ED6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B18EC7 mov eax, dword ptr fs:[00000030h] 23_2_02B18EC7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B8FEC0 mov eax, dword ptr fs:[00000030h] 23_2_02B8FEC0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B036CC mov eax, dword ptr fs:[00000030h] 23_2_02B036CC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B8FE3F mov eax, dword ptr fs:[00000030h] 23_2_02B8FE3F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADE620 mov eax, dword ptr fs:[00000030h] 23_2_02ADE620
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0A61C mov eax, dword ptr fs:[00000030h] 23_2_02B0A61C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0A61C mov eax, dword ptr fs:[00000030h] 23_2_02B0A61C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADC600 mov eax, dword ptr fs:[00000030h] 23_2_02ADC600
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADC600 mov eax, dword ptr fs:[00000030h] 23_2_02ADC600
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02ADC600 mov eax, dword ptr fs:[00000030h] 23_2_02ADC600
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B08E00 mov eax, dword ptr fs:[00000030h] 23_2_02B08E00
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91608 mov eax, dword ptr fs:[00000030h] 23_2_02B91608
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE766D mov eax, dword ptr fs:[00000030h] 23_2_02AE766D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AFAE73 mov eax, dword ptr fs:[00000030h] 23_2_02AFAE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AFAE73 mov eax, dword ptr fs:[00000030h] 23_2_02AFAE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AFAE73 mov eax, dword ptr fs:[00000030h] 23_2_02AFAE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AFAE73 mov eax, dword ptr fs:[00000030h] 23_2_02AFAE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AFAE73 mov eax, dword ptr fs:[00000030h] 23_2_02AFAE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE7E41 mov eax, dword ptr fs:[00000030h] 23_2_02AE7E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE7E41 mov eax, dword ptr fs:[00000030h] 23_2_02AE7E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE7E41 mov eax, dword ptr fs:[00000030h] 23_2_02AE7E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE7E41 mov eax, dword ptr fs:[00000030h] 23_2_02AE7E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE7E41 mov eax, dword ptr fs:[00000030h] 23_2_02AE7E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE7E41 mov eax, dword ptr fs:[00000030h] 23_2_02AE7E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9AE44 mov eax, dword ptr fs:[00000030h] 23_2_02B9AE44
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9AE44 mov eax, dword ptr fs:[00000030h] 23_2_02B9AE44
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B57794 mov eax, dword ptr fs:[00000030h] 23_2_02B57794
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B57794 mov eax, dword ptr fs:[00000030h] 23_2_02B57794
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B57794 mov eax, dword ptr fs:[00000030h] 23_2_02B57794
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE8794 mov eax, dword ptr fs:[00000030h] 23_2_02AE8794
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B137F5 mov eax, dword ptr fs:[00000030h] 23_2_02B137F5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0E730 mov eax, dword ptr fs:[00000030h] 23_2_02B0E730
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD4F2E mov eax, dword ptr fs:[00000030h] 23_2_02AD4F2E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD4F2E mov eax, dword ptr fs:[00000030h] 23_2_02AD4F2E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B6FF10 mov eax, dword ptr fs:[00000030h] 23_2_02B6FF10
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B6FF10 mov eax, dword ptr fs:[00000030h] 23_2_02B6FF10
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA070D mov eax, dword ptr fs:[00000030h] 23_2_02BA070D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA070D mov eax, dword ptr fs:[00000030h] 23_2_02BA070D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AFF716 mov eax, dword ptr fs:[00000030h] 23_2_02AFF716
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0A70E mov eax, dword ptr fs:[00000030h] 23_2_02B0A70E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0A70E mov eax, dword ptr fs:[00000030h] 23_2_02B0A70E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AEFF60 mov eax, dword ptr fs:[00000030h] 23_2_02AEFF60
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA8F6A mov eax, dword ptr fs:[00000030h] 23_2_02BA8F6A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AEEF40 mov eax, dword ptr fs:[00000030h] 23_2_02AEEF40
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AE849B mov eax, dword ptr fs:[00000030h] 23_2_02AE849B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B914FB mov eax, dword ptr fs:[00000030h] 23_2_02B914FB
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B56CF0 mov eax, dword ptr fs:[00000030h] 23_2_02B56CF0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B56CF0 mov eax, dword ptr fs:[00000030h] 23_2_02B56CF0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B56CF0 mov eax, dword ptr fs:[00000030h] 23_2_02B56CF0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA8CD6 mov eax, dword ptr fs:[00000030h] 23_2_02BA8CD6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0BC2C mov eax, dword ptr fs:[00000030h] 23_2_02B0BC2C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA740D mov eax, dword ptr fs:[00000030h] 23_2_02BA740D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA740D mov eax, dword ptr fs:[00000030h] 23_2_02BA740D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA740D mov eax, dword ptr fs:[00000030h] 23_2_02BA740D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B91C06 mov eax, dword ptr fs:[00000030h] 23_2_02B91C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B56C0A mov eax, dword ptr fs:[00000030h] 23_2_02B56C0A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B56C0A mov eax, dword ptr fs:[00000030h] 23_2_02B56C0A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B56C0A mov eax, dword ptr fs:[00000030h] 23_2_02B56C0A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B56C0A mov eax, dword ptr fs:[00000030h] 23_2_02B56C0A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AF746D mov eax, dword ptr fs:[00000030h] 23_2_02AF746D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B6C450 mov eax, dword ptr fs:[00000030h] 23_2_02B6C450
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B6C450 mov eax, dword ptr fs:[00000030h] 23_2_02B6C450
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0A44B mov eax, dword ptr fs:[00000030h] 23_2_02B0A44B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B01DB5 mov eax, dword ptr fs:[00000030h] 23_2_02B01DB5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B01DB5 mov eax, dword ptr fs:[00000030h] 23_2_02B01DB5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B01DB5 mov eax, dword ptr fs:[00000030h] 23_2_02B01DB5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B035A1 mov eax, dword ptr fs:[00000030h] 23_2_02B035A1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA05AC mov eax, dword ptr fs:[00000030h] 23_2_02BA05AC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02BA05AC mov eax, dword ptr fs:[00000030h] 23_2_02BA05AC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD2D8A mov eax, dword ptr fs:[00000030h] 23_2_02AD2D8A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD2D8A mov eax, dword ptr fs:[00000030h] 23_2_02AD2D8A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD2D8A mov eax, dword ptr fs:[00000030h] 23_2_02AD2D8A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD2D8A mov eax, dword ptr fs:[00000030h] 23_2_02AD2D8A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AD2D8A mov eax, dword ptr fs:[00000030h] 23_2_02AD2D8A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0FD9B mov eax, dword ptr fs:[00000030h] 23_2_02B0FD9B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B0FD9B mov eax, dword ptr fs:[00000030h] 23_2_02B0FD9B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B02581 mov eax, dword ptr fs:[00000030h] 23_2_02B02581
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B02581 mov eax, dword ptr fs:[00000030h] 23_2_02B02581
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B02581 mov eax, dword ptr fs:[00000030h] 23_2_02B02581
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B02581 mov eax, dword ptr fs:[00000030h] 23_2_02B02581
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B88DF1 mov eax, dword ptr fs:[00000030h] 23_2_02B88DF1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AED5E0 mov eax, dword ptr fs:[00000030h] 23_2_02AED5E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02AED5E0 mov eax, dword ptr fs:[00000030h] 23_2_02AED5E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9FDE2 mov eax, dword ptr fs:[00000030h] 23_2_02B9FDE2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9FDE2 mov eax, dword ptr fs:[00000030h] 23_2_02B9FDE2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 23_2_02B9FDE2 mov eax, dword ptr fs:[00000030h] 23_2_02B9FDE2
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\ipconfig.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\HAWB AND INV.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.premier-moment.info
Source: C:\Windows\explorer.exe Domain query: www.dinkoistmatrimony.com
Source: C:\Windows\explorer.exe Domain query: www.vipbrandwatch.info
Source: C:\Windows\explorer.exe Domain query: www.networkingmaderas.com
Source: C:\Windows\explorer.exe Domain query: www.curvygirlholiday.com
Source: C:\Windows\explorer.exe Domain query: www.ecosanhn.com
Source: C:\Windows\explorer.exe Network Connect: 181.214.142.2 80
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80
Source: C:\Windows\explorer.exe Network Connect: 107.180.57.119 80
Source: C:\Windows\explorer.exe Network Connect: 202.254.234.152 80
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HAWB AND INV.exe'
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe'
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe'
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HAWB AND INV.exe' Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe' Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe' Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\HAWB AND INV.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\HAWB AND INV.exe Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write
Source: C:\Users\user\Desktop\HAWB AND INV.exe Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\HAWB AND INV.exe Thread register set: target process: 3440
Source: C:\Windows\SysWOW64\ipconfig.exe Thread register set: target process: 3440
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\HAWB AND INV.exe Thread APC queued: target process: C:\Windows\explorer.exe
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\HAWB AND INV.exe Section unmapped: C:\Windows\SysWOW64\ipconfig.exe base address: AA0000
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HAWB AND INV.exe' Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe' Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\qxnptkmQbHB' /XML 'C:\Users\user\AppData\Local\Temp\tmp9D41.tmp' Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\qxnptkmQbHB.exe' Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Process created: C:\Users\user\Desktop\HAWB AND INV.exe C:\Users\user\Desktop\HAWB AND INV.exe Jump to behavior
Source: explorer.exe, 0000000B.00000000.410165765.00000000083EB000.00000004.00000001.sdmp, ipconfig.exe, 00000017.00000002.598358599.0000000005100000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000B.00000002.593443753.00000000008B8000.00000004.00000020.sdmp, ipconfig.exe, 00000017.00000002.598358599.0000000005100000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000B.00000002.596560849.0000000000EE0000.00000002.00000001.sdmp, ipconfig.exe, 00000017.00000002.598358599.0000000005100000.00000002.00000001.sdmp Binary or memory string: &Program Manager
Source: explorer.exe, 0000000B.00000002.596560849.0000000000EE0000.00000002.00000001.sdmp, ipconfig.exe, 00000017.00000002.598358599.0000000005100000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\HAWB AND INV.exe Queries volume information: C:\Users\user\Desktop\HAWB AND INV.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HAWB AND INV.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Users\user\Desktop\HAWB AND INV.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 0000000A.00000002.473823367.0000000000C50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.593665337.0000000000880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.470161659.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.482267255.00000000014E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.591815076.0000000000110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.350474951.0000000003CE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.593621716.0000000000850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 10.2.HAWB AND INV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.HAWB AND INV.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HAWB AND INV.exe.3d81880.3.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 0000000A.00000002.473823367.0000000000C50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.593665337.0000000000880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.470161659.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.482267255.00000000014E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.591815076.0000000000110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.350474951.0000000003CE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.593621716.0000000000850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 10.2.HAWB AND INV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.HAWB AND INV.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HAWB AND INV.exe.3d81880.3.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 402848 Sample: HAWB AND INV.exe Startdate: 03/05/2021 Architecture: WINDOWS Score: 100 43 www.jaimericart.com 2->43 45 www.beachrockisland.com 2->45 47 2 other IPs or domains 2->47 61 Found malware configuration 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 Multi AV Scanner detection for dropped file 2->65 67 10 other signatures 2->67 9 HAWB AND INV.exe 7 2->9         started        signatures3 process4 file5 37 C:\Users\user\AppData\...\qxnptkmQbHB.exe, PE32 9->37 dropped 39 C:\Users\user\AppData\Local\...\tmp9D41.tmp, XML 9->39 dropped 41 C:\Users\user\...\HAWB AND INV.exe.log, ASCII 9->41 dropped 73 Adds a directory exclusion to Windows Defender 9->73 13 HAWB AND INV.exe 9->13         started        16 powershell.exe 26 9->16         started        18 powershell.exe 24 9->18         started        20 2 other processes 9->20 signatures6 process7 signatures8 75 Modifies the context of a thread in another process (thread injection) 13->75 77 Maps a DLL or memory area into another process 13->77 79 Sample uses process hollowing technique 13->79 81 Queues an APC in another process (thread injection) 13->81 22 explorer.exe 13->22 injected 26 conhost.exe 16->26         started        28 conhost.exe 18->28         started        30 conhost.exe 20->30         started        32 conhost.exe 20->32         started        process9 dnsIp10 49 www.premier-moment.info 202.254.234.152, 49757, 80 SAKURA-CSAKURAInternetIncJP Japan 22->49 51 ecosanhn.com 181.214.142.2, 49760, 80 ASDETUKhttpwwwheficedcomGB Chile 22->51 53 8 other IPs or domains 22->53 69 System process connects to network (likely due to code injection or exploit) 22->69 71 Uses ipconfig to lookup or modify the Windows network settings 22->71 34 ipconfig.exe 22->34         started        signatures11 process12 signatures13 55 Modifies the context of a thread in another process (thread injection) 34->55 57 Maps a DLL or memory area into another process 34->57 59 Tries to detect virtualization through RDTSC time measurements 34->59
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
181.214.142.2
 ecosanhn.com Chile
61317 ASDETUKhttpwwwheficedcomGB true
34.102.136.180
 dinkoistmatrimony.com United States
15169 GOOGLEUS false
107.180.57.119
 networkingmaderas.com United States
26496 AS-26496-GO-DADDY-COM-LLCUS true
202.254.234.152
 www.premier-moment.info Japan 9371 SAKURA-CSAKURAInternetIncJP true

Contacted Domains

Name IP Active
www.premier-moment.info 202.254.234.152 true
ecosanhn.com 181.214.142.2 true
jaimericart.com 81.88.48.71 true
networkingmaderas.com 107.180.57.119 true
www.itechfreak.com 192.238.144.41 true
dinkoistmatrimony.com 34.102.136.180 true
curvygirlholiday.com 34.102.136.180 true
www.vipbrandwatch.info unknown unknown
www.networkingmaderas.com unknown unknown
www.beachrockisland.com unknown unknown
www.curvygirlholiday.com unknown unknown
www.dinkoistmatrimony.com unknown unknown
www.ecosanhn.com unknown unknown
www.jaimericart.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.premier-moment.info/maw9/?AVF=6+c9WwA91vc3q1qPV/bxdb4jLCwfrBo6mkGAjXedmMMeaWqNVTNOJ33lEW7rMTYT0EzxW77dCg==&6l=sHbLpdw8x0Nx4 true
  • Avira URL Cloud: safe
 unknown
www.alldaazz.com/maw9/ true
  • Avira URL Cloud: safe
 low
http://www.networkingmaderas.com/maw9/?AVF=CxDYGZqaFGf+wggxXYaRsXxHYh0vkMvLuxQU/eiz8BKY71rUvugXdjEA5Q+gRIVecMz1lX5ZhQ==&6l=sHbLpdw8x0Nx4 true
  • Avira URL Cloud: safe
 unknown
http://www.dinkoistmatrimony.com/maw9/?AVF=4eDAg+VUuFTPb+HpMV2XwHXrAkW6c8A/v4D4zAieFew51h9R0F5m+f+tz7m/68XBKeAB57yd0w==&6l=sHbLpdw8x0Nx4 false
  • Avira URL Cloud: safe
 unknown
http://www.ecosanhn.com/maw9/?AVF=cbTyfQFVyV4qwzSuB5gkHhMhd4ZKxxzMSggVhGr4392xKRAUAYS1aRQvNzIyvi+llhoR0m7eyA==&6l=sHbLpdw8x0Nx4 true
  • Avira URL Cloud: safe
 unknown
http://www.curvygirlholiday.com/maw9/?AVF=ueXSnp9RuZV4VGv1GREwgsKbz6ngTp3QynINalfLY22/qL3buQO/ZY9WhadtjkGC+9EglwJKpA==&6l=sHbLpdw8x0Nx4 false
  • Avira URL Cloud: safe
 unknown