Windows Analysis Report
SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe

Overview

General Information

Sample name: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe
Analysis ID: 1482798
MD5: 73457bb8a567efa5f99f7c4962ce1393
SHA1: a6924039c86ccdaa16d2221da09d713de8cf9996
SHA256: 7942971e2a6b2af6bf4b1d0cc397fa9d67c2f3a90bf5cc241ff3a3ed362f5d67
Tags: exe
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe ReversingLabs: Detection: 36%
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Virustotal: Detection: 33% Perma Link
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.1951644033.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1952219358.0000000001840000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000003.00000002.1952342139.0000000001940000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000003.00000002.1952342139.0000000001940000.00000040.00001000.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 4x nop then jmp 07E77AEBh 0_2_07E77F28
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 4x nop then jmp 07E77AEBh 0_2_07E7803D
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1737300139.00000000033A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name8
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742583735.0000000007532000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.1951644033.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1952219358.0000000001840000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.1951644033.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.1952219358.0000000001840000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
.NET source code contains very large array initializations
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, AspMvcViewLocationFormatAttribute.cs Large array initialization: : array initializer size 629909
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0042C1F3 NtClose, 3_2_0042C1F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2B60 NtClose,LdrInitializeThunk, 3_2_019B2B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2DF0 NtQuerySystemInformation,LdrInitializeThunk, 3_2_019B2DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2C70 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_019B2C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B35C0 NtCreateMutant,LdrInitializeThunk, 3_2_019B35C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B4340 NtSetContextThread, 3_2_019B4340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B4650 NtSuspendThread, 3_2_019B4650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2B80 NtQueryInformationFile, 3_2_019B2B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2BA0 NtEnumerateValueKey, 3_2_019B2BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2BF0 NtAllocateVirtualMemory, 3_2_019B2BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2BE0 NtQueryValueKey, 3_2_019B2BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2AB0 NtWaitForSingleObject, 3_2_019B2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2AD0 NtReadFile, 3_2_019B2AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2AF0 NtWriteFile, 3_2_019B2AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2DB0 NtEnumerateKey, 3_2_019B2DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2DD0 NtDelayExecution, 3_2_019B2DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2D10 NtMapViewOfSection, 3_2_019B2D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2D00 NtSetInformationFile, 3_2_019B2D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2D30 NtUnmapViewOfSection, 3_2_019B2D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2CA0 NtQueryInformationToken, 3_2_019B2CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2CC0 NtQueryVirtualMemory, 3_2_019B2CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2CF0 NtOpenProcess, 3_2_019B2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2C00 NtQueryInformationProcess, 3_2_019B2C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2C60 NtCreateKey, 3_2_019B2C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2F90 NtProtectVirtualMemory, 3_2_019B2F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2FB0 NtResumeThread, 3_2_019B2FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2FA0 NtQuerySection, 3_2_019B2FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2FE0 NtCreateFile, 3_2_019B2FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2F30 NtCreateSection, 3_2_019B2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2F60 NtCreateProcessEx, 3_2_019B2F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2E80 NtReadVirtualMemory, 3_2_019B2E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2EA0 NtAdjustPrivilegesToken, 3_2_019B2EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2EE0 NtQueueApcThread, 3_2_019B2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2E30 NtWriteVirtualMemory, 3_2_019B2E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B3090 NtSetValueKey, 3_2_019B3090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B3010 NtOpenDirectoryObject, 3_2_019B3010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B39B0 NtGetContextThread, 3_2_019B39B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B3D10 NtOpenProcessToken, 3_2_019B3D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B3D70 NtOpenThread, 3_2_019B3D70
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_05F54420 0_2_05F54420
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_05F53558 0_2_05F53558
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_05F5B040 0_2_05F5B040
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_05F5B030 0_2_05F5B030
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E779B9 0_2_07E779B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E70040 0_2_07E70040
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E7A788 0_2_07E7A788
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E74798 0_2_07E74798
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E73488 0_2_07E73488
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E73498 0_2_07E73498
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E7A42C 0_2_07E7A42C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E72C28 0_2_07E72C28
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E72C08 0_2_07E72C08
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E751F0 0_2_07E751F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E73060 0_2_07E73060
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E79879 0_2_07E79879
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E73050 0_2_07E73050
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_07E70006 0_2_07E70006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0042E813 3_2_0042E813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00410163 3_2_00410163
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00401100 3_2_00401100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040E1E3 3_2_0040E1E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040E18A 3_2_0040E18A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00416D13 3_2_00416D13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00402520 3_2_00402520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040FF43 3_2_0040FF43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00402F50 3_2_00402F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A341A2 3_2_01A341A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A401AA 3_2_01A401AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A381CC 3_2_01A381CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01970100 3_2_01970100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1A118 3_2_01A1A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A08158 3_2_01A08158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A12000 3_2_01A12000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A403E6 3_2_01A403E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198E3F0 3_2_0198E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3A352 3_2_01A3A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A002C0 3_2_01A002C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A40591 3_2_01A40591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980535 3_2_01980535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A2E4F6 3_2_01A2E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A24420 3_2_01A24420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A32446 3_2_01A32446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197C7C0 3_2_0197C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A4750 3_2_019A4750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199C6E0 3_2_0199C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A4A9A6 3_2_01A4A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01996962 3_2_01996962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019668B8 3_2_019668B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE8F0 3_2_019AE8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198A840 3_2_0198A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01982840 3_2_01982840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A36BD7 3_2_01A36BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3AB40 3_2_01A3AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197EA80 3_2_0197EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01998DBF 3_2_01998DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197ADE0 3_2_0197ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198AD00 3_2_0198AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1CD1F 3_2_01A1CD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20CB5 3_2_01A20CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01970CF2 3_2_01970CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980C00 3_2_01980C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FEFA0 3_2_019FEFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01972FC8 3_2_01972FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A22F30 3_2_01A22F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A0F30 3_2_019A0F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019C2F28 3_2_019C2F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F4F40 3_2_019F4F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01992E90 3_2_01992E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3CE93 3_2_01A3CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3EEDB 3_2_01A3EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3EE26 3_2_01A3EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980E59 3_2_01980E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198B1B0 3_2_0198B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A4B16B 3_2_01A4B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196F172 3_2_0196F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B516C 3_2_019B516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3F0E0 3_2_01A3F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A370E9 3_2_01A370E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019870C0 3_2_019870C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A2F0CC 3_2_01A2F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019C739A 3_2_019C739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3132D 3_2_01A3132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196D34C 3_2_0196D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019852A0 3_2_019852A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A212ED 3_2_01A212ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199B2C0 3_2_0199B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1D5B0 3_2_01A1D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A495C3 3_2_01A495C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A37571 3_2_01A37571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3F43F 3_2_01A3F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01971460 3_2_01971460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3F7B0 3_2_01A3F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A316CC 3_2_01A316CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019C5630 3_2_019C5630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A15910 3_2_01A15910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01989950 3_2_01989950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199B950 3_2_0199B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019838E0 3_2_019838E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019ED800 3_2_019ED800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199FB80 3_2_0199FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019BDBF9 3_2_019BDBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F5BF0 3_2_019F5BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3FB76 3_2_01A3FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A21AA3 3_2_01A21AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1DAAC 3_2_01A1DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019C5AA0 3_2_019C5AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A2DAC6 3_2_01A2DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A37A46 3_2_01A37A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3FA49 3_2_01A3FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F3A6C 3_2_019F3A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199FDC0 3_2_0199FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A37D73 3_2_01A37D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01983D40 3_2_01983D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A31D5A 3_2_01A31D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3FCF2 3_2_01A3FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F9C32 3_2_019F9C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01981F92 3_2_01981F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3FFB1 3_2_01A3FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01943FD5 3_2_01943FD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01943FD2 3_2_01943FD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3FF09 3_2_01A3FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01989EB0 3_2_01989EB0
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0196B970 appears 265 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 019C7E54 appears 108 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 019B5130 appears 58 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 019FF290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 019EEA12 appears 86 times
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1745435507.0000000007FD0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1738423726.000000000457E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000000.1697408380.000000000106A000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameEcHV.exe2 vs SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1736092150.000000000156E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1737300139.00000000033A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMML.dll2 vs SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1743162307.0000000007A10000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMML.dll2 vs SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Binary or memory string: OriginalFilenameEcHV.exe2 vs SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe
Uses 32bit PE files
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.1951644033.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.1952219358.0000000001840000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, qd3nAG3jlfZH0Oy1Yi.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, lOsHXAsovXZfc94OB5.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, lOsHXAsovXZfc94OB5.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, lOsHXAsovXZfc94OB5.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, qd3nAG3jlfZH0Oy1Yi.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, lOsHXAsovXZfc94OB5.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, lOsHXAsovXZfc94OB5.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, lOsHXAsovXZfc94OB5.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, lOsHXAsovXZfc94OB5.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, lOsHXAsovXZfc94OB5.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, lOsHXAsovXZfc94OB5.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, qd3nAG3jlfZH0Oy1Yi.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1742221983.0000000005CFC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: EITC Tempus Sans is a Trademark of International Typeface Corporation.slnt
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/6@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.log Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Mutant created: \Sessions\1\BaseNamedObjects\EaaLEWdZQ
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7508:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1wco4vy5.omd.ps1 Jump to behavior
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe ReversingLabs: Detection: 36%
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Virustotal: Detection: 33%
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000003.00000002.1952342139.0000000001940000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000003.00000002.1952342139.0000000001940000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, lOsHXAsovXZfc94OB5.cs .Net Code: vVjubMZxL1 System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.33cdd5c.0.raw.unpack, -.cs .Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.33cdd5c.0.raw.unpack, PingPong.cs .Net Code: Justy
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7a10000.3.raw.unpack, -.cs .Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7a10000.3.raw.unpack, PingPong.cs .Net Code: Justy
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, lOsHXAsovXZfc94OB5.cs .Net Code: vVjubMZxL1 System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, lOsHXAsovXZfc94OB5.cs .Net Code: vVjubMZxL1 System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Code function: 0_2_05F50B2C pushad ; ret 0_2_05F50B2D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00406075 pushfd ; iretd 3_2_00406076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0042E093 pushad ; retf 3_2_0042E0AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004031C0 push eax; ret 3_2_004031C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041198D push ss; retf 3_2_00411997
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00418AC1 push ecx; iretd 3_2_00418AC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00411AC0 push ebx; ret 3_2_00411AC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004082CC push esp; iretd 3_2_004082CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004083F8 push edi; iretd 3_2_0040840C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00418CA1 push 00000020h; iretd 3_2_00418CA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00418DAB push 51EF2DE3h; retf 3_2_00418DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00402F45 push 0000004Dh; ret 3_2_00402F47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00401729 push ecx; iretd 3_2_0040172D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0194225F pushad ; ret 3_2_019427F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019427FA pushad ; ret 3_2_019427F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019709AD push ecx; mov dword ptr [esp], ecx 3_2_019709B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0194283D push eax; iretd 3_2_01942858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01941368 push eax; iretd 3_2_01941369
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Static PE information: section name: .text entropy: 7.865847930042044
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, qd3nAG3jlfZH0Oy1Yi.cs High entropy of concatenated method names: 'jnXw0T1meY', 'tmrw9IJxid', 'wo8w1owiBy', 'VkuwtkoIfg', 'hRZwRTyewq', 'apIwNAFHvT', 'SEowe4QvTO', 'vPmwCR55GL', 'xT9wQbfw9w', 'dl7wOrl9J1'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, MA4fwJjxpQtUWpwAG7.cs High entropy of concatenated method names: 'bXer8Ak3HT', 'kubrsE1Mng', 'ToString', 'dwPr3TXDSN', 'zEurwhCbp2', 'KQVrnGPJ3P', 'BGsr236y3k', 'pGKrXAIeVQ', 'CJYrBDYxpE', 'dZLrapLjTj'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, Mti1Tar8aHQgpMfdfx.cs High entropy of concatenated method names: 'CUPBZSPSjd', 'sbLBdEdJ7V', 'qGfBbe1q1V', 'TD4BKpBaao', 'mgLBmymKrD', 'UPCBYoKcn8', 'GHQBg0aCwm', 'fZeBTxyhBu', 'jn4B6kmmZj', 'QKhBhscXaL'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, cxjq8XAX0qtiRVq2yE.cs High entropy of concatenated method names: 'mK8xTajwxh', 'iWVx62Xbtx', 'lsNx7knWHb', 'RCNxAguPHs', 'aV6xFbtDDT', 'mtexL4ivcF', 'e6UxGuK2UD', 'fg4xpQda5C', 'WX4xvfpa43', 'GSXxo3fmmE'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, Flke5KNiPuDujaxXIy.cs High entropy of concatenated method names: 'PT4XUWlwWK', 'rkrXwBthU9', 'JCUX2D4ZSj', 'hVlXBJaaq0', 'FJaXaTR9ql', 'Gua2R99gnw', 'R9c2NIfPT8', 'CBC2eyiwbN', 'u8t2CqXDNp', 'qhu2QLGoBy'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, OkjXWLz7Wrhdbhf0p6.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Xj3WxehWTa', 'I8KWiPHqAV', 'r2QWDBU2TK', 'sv9WrR53Sh', 'iIPWIaZqV1', 'Ps5WWsRcAe', 'CesWSs0JlO'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, Hb2mLSpRPxj2MrDSA2.cs High entropy of concatenated method names: 'jXWWqKKokS', 'UW5WMojc6H', 'F0sWucX0Tp', 'alQW3b7OUQ', 'aUlWw1PNSB', 'zMhW21tJHt', 'YuOWXyXb7Z', 'Y4KIe1mSjF', 'ATSICXK7Yg', 'nHeIQHh9O1'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, WEjhlUYfc9VNS4DJnO.cs High entropy of concatenated method names: 'Dispose', 'l1fqQMjoKS', 'GpyfASftIB', 'EXkccM1RDQ', 'tM8qOnH0LW', 'zNRqzn3Dft', 'ProcessDialogKey', 'tshfy6nWYW', 'DQwfqwKUce', 'C6Fffwysd2'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, IIqGQ2xop5lTVf7YeR.cs High entropy of concatenated method names: 'ttvnKPS7lF', 'Ly6nYfrPe3', 'DRRnTpmDSi', 'M6Xn6mDtQe', 'm7gniS5pWR', 'kLSnDGm1vv', 'US5nrtdud2', 'b51nIrXHGD', 'YHInWcg2Vj', 'mJknSPWrvv'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, jmw9js1ffRhMZkCR7uZ.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'SPSS0ggCeR', 'XdyS9wlEPp', 'kUPS1N8ffI', 'aLRStJNmbl', 'Tx4SRkOZQi', 'uIgSNmoQi2', 'ufRSeqkKpx'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, XkB4artdCQHBJUoEX9.cs High entropy of concatenated method names: 'Mpk2mX4wMh', 'omF2gS607v', 'Op9nPciut4', 'Ct3nFvSfWt', 'ks7nLYYJyW', 'wJInHMc7L7', 'IpbnG8fZI7', 'kMynpUm3jt', 'l71nlonlJQ', 'qH5nv4S2BP'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, MoejmB9uWWBnkrZFVZ.cs High entropy of concatenated method names: 'plmI35fGhG', 'BfbIwf54ep', 'jc1In5YgnB', 'a4kI2NT9Kw', 'g0LIXjyHw2', 'laDIBR9uCK', 'LKUIa2Evy1', 'cvpIjDTUAy', 'wZuI8ITXwx', 'fDsIsPkPlm'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, WZq6cY1H5ntXmnCkDcV.cs High entropy of concatenated method names: 'U8tSZU6llu', 'NZOSdWRsJt', 'CFGSbiw8ar', 'FRpkUKBzs6ke3e4yZsb', 'PtHQpgJ4AP5nc3hMR60', 'JLyjwLJbcAMHG6upYU7', 'QB02xfJneRiQRDQdKK5'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, GdVpNdHph65Xr3MQNJ.cs High entropy of concatenated method names: 'CIOb1tuwt', 'zCmKNueKH', 'Q8CYN0H4H', 'd7ngXayTQ', 'Grn6EpXyK', 'QwEhrEywD', 'HCvgenGjCxLNupbv65', 'SZLaJHgtKYjYa9GdMJ', 'focITw3yq', 'BAcSL1APC'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, mg30r0LvvjO4WBi4Lq.cs High entropy of concatenated method names: 'ToString', 'EUyDow5BVR', 'h8uDA9It9u', 'QgRDPJAHEH', 'c1nDFZ1OL1', 'NbvDLrP91a', 'CEDDHNUGnf', 'hOqDGuKd1V', 'BkHDpwEMx1', 'r5SDlTQF7u'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, sjFY1MeLbRxNIpof7F.cs High entropy of concatenated method names: 'jigqBygbCY', 'tDhqaTgEcd', 'e1Qq8Gbl62', 'BauqsotPLY', 'iEYqibSLsi', 'iJWqD6IsUW', 'RVxmBlteOuB3LbryVq', 'uOG9mX8nWL8NtAnOXO', 'fr6qqx2D6J', 'UvrqMubBmA'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, Kgf4xNGn4VbYqvmk5H.cs High entropy of concatenated method names: 'Q8CrC6P9o0', 'zJXrOrc8De', 'JI9Iy95l6s', 'aqbIqiokhx', 'xJXroCNBqB', 'wLKr4Hjje2', 'ig9rJcuvPa', 'vfTr0I77LI', 'j4kr9NsNHH', 'yn0r1XY54L'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, lOsHXAsovXZfc94OB5.cs High entropy of concatenated method names: 'WktMU2cTbG', 'x5hM3yGQUM', 'gRpMwPZJe1', 'UPYMn1JRLN', 'LjlM2fgDtf', 'r2bMXgUbuY', 'Fr4MBT33D2', 'vBpMaqk9aq', 'ko9Mj8HQLZ', 'RyZM85rkTZ'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, LB6mXH10Ukg0a6Bg1Fb.cs High entropy of concatenated method names: 'eZDWZyXd0D', 'LLPWd6yhiJ', 'z2uWb2hBwt', 'amAWKJoZMP', 'swnWmeVjEy', 'opGWY2eX1r', 'VdrWgRdSPU', 'zAMWThCyys', 'CN1W6qRsLr', 'K2QWhBSeYO'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.47b3210.1.raw.unpack, OEUYs3ofI7bWQpg2kV.cs High entropy of concatenated method names: 'G4oI7WkAoK', 'syeIA30dth', 'TuFIP7hPlF', 'rcdIFo7Hij', 'A5MI0jyQnJ', 'vchILcbcKO', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, qd3nAG3jlfZH0Oy1Yi.cs High entropy of concatenated method names: 'jnXw0T1meY', 'tmrw9IJxid', 'wo8w1owiBy', 'VkuwtkoIfg', 'hRZwRTyewq', 'apIwNAFHvT', 'SEowe4QvTO', 'vPmwCR55GL', 'xT9wQbfw9w', 'dl7wOrl9J1'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, MA4fwJjxpQtUWpwAG7.cs High entropy of concatenated method names: 'bXer8Ak3HT', 'kubrsE1Mng', 'ToString', 'dwPr3TXDSN', 'zEurwhCbp2', 'KQVrnGPJ3P', 'BGsr236y3k', 'pGKrXAIeVQ', 'CJYrBDYxpE', 'dZLrapLjTj'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, Mti1Tar8aHQgpMfdfx.cs High entropy of concatenated method names: 'CUPBZSPSjd', 'sbLBdEdJ7V', 'qGfBbe1q1V', 'TD4BKpBaao', 'mgLBmymKrD', 'UPCBYoKcn8', 'GHQBg0aCwm', 'fZeBTxyhBu', 'jn4B6kmmZj', 'QKhBhscXaL'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, cxjq8XAX0qtiRVq2yE.cs High entropy of concatenated method names: 'mK8xTajwxh', 'iWVx62Xbtx', 'lsNx7knWHb', 'RCNxAguPHs', 'aV6xFbtDDT', 'mtexL4ivcF', 'e6UxGuK2UD', 'fg4xpQda5C', 'WX4xvfpa43', 'GSXxo3fmmE'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, Flke5KNiPuDujaxXIy.cs High entropy of concatenated method names: 'PT4XUWlwWK', 'rkrXwBthU9', 'JCUX2D4ZSj', 'hVlXBJaaq0', 'FJaXaTR9ql', 'Gua2R99gnw', 'R9c2NIfPT8', 'CBC2eyiwbN', 'u8t2CqXDNp', 'qhu2QLGoBy'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, OkjXWLz7Wrhdbhf0p6.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Xj3WxehWTa', 'I8KWiPHqAV', 'r2QWDBU2TK', 'sv9WrR53Sh', 'iIPWIaZqV1', 'Ps5WWsRcAe', 'CesWSs0JlO'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, Hb2mLSpRPxj2MrDSA2.cs High entropy of concatenated method names: 'jXWWqKKokS', 'UW5WMojc6H', 'F0sWucX0Tp', 'alQW3b7OUQ', 'aUlWw1PNSB', 'zMhW21tJHt', 'YuOWXyXb7Z', 'Y4KIe1mSjF', 'ATSICXK7Yg', 'nHeIQHh9O1'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, WEjhlUYfc9VNS4DJnO.cs High entropy of concatenated method names: 'Dispose', 'l1fqQMjoKS', 'GpyfASftIB', 'EXkccM1RDQ', 'tM8qOnH0LW', 'zNRqzn3Dft', 'ProcessDialogKey', 'tshfy6nWYW', 'DQwfqwKUce', 'C6Fffwysd2'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, IIqGQ2xop5lTVf7YeR.cs High entropy of concatenated method names: 'ttvnKPS7lF', 'Ly6nYfrPe3', 'DRRnTpmDSi', 'M6Xn6mDtQe', 'm7gniS5pWR', 'kLSnDGm1vv', 'US5nrtdud2', 'b51nIrXHGD', 'YHInWcg2Vj', 'mJknSPWrvv'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, jmw9js1ffRhMZkCR7uZ.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'SPSS0ggCeR', 'XdyS9wlEPp', 'kUPS1N8ffI', 'aLRStJNmbl', 'Tx4SRkOZQi', 'uIgSNmoQi2', 'ufRSeqkKpx'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, XkB4artdCQHBJUoEX9.cs High entropy of concatenated method names: 'Mpk2mX4wMh', 'omF2gS607v', 'Op9nPciut4', 'Ct3nFvSfWt', 'ks7nLYYJyW', 'wJInHMc7L7', 'IpbnG8fZI7', 'kMynpUm3jt', 'l71nlonlJQ', 'qH5nv4S2BP'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, MoejmB9uWWBnkrZFVZ.cs High entropy of concatenated method names: 'plmI35fGhG', 'BfbIwf54ep', 'jc1In5YgnB', 'a4kI2NT9Kw', 'g0LIXjyHw2', 'laDIBR9uCK', 'LKUIa2Evy1', 'cvpIjDTUAy', 'wZuI8ITXwx', 'fDsIsPkPlm'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, WZq6cY1H5ntXmnCkDcV.cs High entropy of concatenated method names: 'U8tSZU6llu', 'NZOSdWRsJt', 'CFGSbiw8ar', 'FRpkUKBzs6ke3e4yZsb', 'PtHQpgJ4AP5nc3hMR60', 'JLyjwLJbcAMHG6upYU7', 'QB02xfJneRiQRDQdKK5'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, GdVpNdHph65Xr3MQNJ.cs High entropy of concatenated method names: 'CIOb1tuwt', 'zCmKNueKH', 'Q8CYN0H4H', 'd7ngXayTQ', 'Grn6EpXyK', 'QwEhrEywD', 'HCvgenGjCxLNupbv65', 'SZLaJHgtKYjYa9GdMJ', 'focITw3yq', 'BAcSL1APC'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, mg30r0LvvjO4WBi4Lq.cs High entropy of concatenated method names: 'ToString', 'EUyDow5BVR', 'h8uDA9It9u', 'QgRDPJAHEH', 'c1nDFZ1OL1', 'NbvDLrP91a', 'CEDDHNUGnf', 'hOqDGuKd1V', 'BkHDpwEMx1', 'r5SDlTQF7u'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, sjFY1MeLbRxNIpof7F.cs High entropy of concatenated method names: 'jigqBygbCY', 'tDhqaTgEcd', 'e1Qq8Gbl62', 'BauqsotPLY', 'iEYqibSLsi', 'iJWqD6IsUW', 'RVxmBlteOuB3LbryVq', 'uOG9mX8nWL8NtAnOXO', 'fr6qqx2D6J', 'UvrqMubBmA'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, Kgf4xNGn4VbYqvmk5H.cs High entropy of concatenated method names: 'Q8CrC6P9o0', 'zJXrOrc8De', 'JI9Iy95l6s', 'aqbIqiokhx', 'xJXroCNBqB', 'wLKr4Hjje2', 'ig9rJcuvPa', 'vfTr0I77LI', 'j4kr9NsNHH', 'yn0r1XY54L'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, lOsHXAsovXZfc94OB5.cs High entropy of concatenated method names: 'WktMU2cTbG', 'x5hM3yGQUM', 'gRpMwPZJe1', 'UPYMn1JRLN', 'LjlM2fgDtf', 'r2bMXgUbuY', 'Fr4MBT33D2', 'vBpMaqk9aq', 'ko9Mj8HQLZ', 'RyZM85rkTZ'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, LB6mXH10Ukg0a6Bg1Fb.cs High entropy of concatenated method names: 'eZDWZyXd0D', 'LLPWd6yhiJ', 'z2uWb2hBwt', 'amAWKJoZMP', 'swnWmeVjEy', 'opGWY2eX1r', 'VdrWgRdSPU', 'zAMWThCyys', 'CN1W6qRsLr', 'K2QWhBSeYO'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.7fd0000.6.raw.unpack, OEUYs3ofI7bWQpg2kV.cs High entropy of concatenated method names: 'G4oI7WkAoK', 'syeIA30dth', 'TuFIP7hPlF', 'rcdIFo7Hij', 'A5MI0jyQnJ', 'vchILcbcKO', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, qd3nAG3jlfZH0Oy1Yi.cs High entropy of concatenated method names: 'jnXw0T1meY', 'tmrw9IJxid', 'wo8w1owiBy', 'VkuwtkoIfg', 'hRZwRTyewq', 'apIwNAFHvT', 'SEowe4QvTO', 'vPmwCR55GL', 'xT9wQbfw9w', 'dl7wOrl9J1'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, MA4fwJjxpQtUWpwAG7.cs High entropy of concatenated method names: 'bXer8Ak3HT', 'kubrsE1Mng', 'ToString', 'dwPr3TXDSN', 'zEurwhCbp2', 'KQVrnGPJ3P', 'BGsr236y3k', 'pGKrXAIeVQ', 'CJYrBDYxpE', 'dZLrapLjTj'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, Mti1Tar8aHQgpMfdfx.cs High entropy of concatenated method names: 'CUPBZSPSjd', 'sbLBdEdJ7V', 'qGfBbe1q1V', 'TD4BKpBaao', 'mgLBmymKrD', 'UPCBYoKcn8', 'GHQBg0aCwm', 'fZeBTxyhBu', 'jn4B6kmmZj', 'QKhBhscXaL'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, cxjq8XAX0qtiRVq2yE.cs High entropy of concatenated method names: 'mK8xTajwxh', 'iWVx62Xbtx', 'lsNx7knWHb', 'RCNxAguPHs', 'aV6xFbtDDT', 'mtexL4ivcF', 'e6UxGuK2UD', 'fg4xpQda5C', 'WX4xvfpa43', 'GSXxo3fmmE'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, Flke5KNiPuDujaxXIy.cs High entropy of concatenated method names: 'PT4XUWlwWK', 'rkrXwBthU9', 'JCUX2D4ZSj', 'hVlXBJaaq0', 'FJaXaTR9ql', 'Gua2R99gnw', 'R9c2NIfPT8', 'CBC2eyiwbN', 'u8t2CqXDNp', 'qhu2QLGoBy'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, OkjXWLz7Wrhdbhf0p6.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Xj3WxehWTa', 'I8KWiPHqAV', 'r2QWDBU2TK', 'sv9WrR53Sh', 'iIPWIaZqV1', 'Ps5WWsRcAe', 'CesWSs0JlO'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, Hb2mLSpRPxj2MrDSA2.cs High entropy of concatenated method names: 'jXWWqKKokS', 'UW5WMojc6H', 'F0sWucX0Tp', 'alQW3b7OUQ', 'aUlWw1PNSB', 'zMhW21tJHt', 'YuOWXyXb7Z', 'Y4KIe1mSjF', 'ATSICXK7Yg', 'nHeIQHh9O1'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, WEjhlUYfc9VNS4DJnO.cs High entropy of concatenated method names: 'Dispose', 'l1fqQMjoKS', 'GpyfASftIB', 'EXkccM1RDQ', 'tM8qOnH0LW', 'zNRqzn3Dft', 'ProcessDialogKey', 'tshfy6nWYW', 'DQwfqwKUce', 'C6Fffwysd2'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, IIqGQ2xop5lTVf7YeR.cs High entropy of concatenated method names: 'ttvnKPS7lF', 'Ly6nYfrPe3', 'DRRnTpmDSi', 'M6Xn6mDtQe', 'm7gniS5pWR', 'kLSnDGm1vv', 'US5nrtdud2', 'b51nIrXHGD', 'YHInWcg2Vj', 'mJknSPWrvv'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, jmw9js1ffRhMZkCR7uZ.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'SPSS0ggCeR', 'XdyS9wlEPp', 'kUPS1N8ffI', 'aLRStJNmbl', 'Tx4SRkOZQi', 'uIgSNmoQi2', 'ufRSeqkKpx'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, XkB4artdCQHBJUoEX9.cs High entropy of concatenated method names: 'Mpk2mX4wMh', 'omF2gS607v', 'Op9nPciut4', 'Ct3nFvSfWt', 'ks7nLYYJyW', 'wJInHMc7L7', 'IpbnG8fZI7', 'kMynpUm3jt', 'l71nlonlJQ', 'qH5nv4S2BP'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, MoejmB9uWWBnkrZFVZ.cs High entropy of concatenated method names: 'plmI35fGhG', 'BfbIwf54ep', 'jc1In5YgnB', 'a4kI2NT9Kw', 'g0LIXjyHw2', 'laDIBR9uCK', 'LKUIa2Evy1', 'cvpIjDTUAy', 'wZuI8ITXwx', 'fDsIsPkPlm'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, WZq6cY1H5ntXmnCkDcV.cs High entropy of concatenated method names: 'U8tSZU6llu', 'NZOSdWRsJt', 'CFGSbiw8ar', 'FRpkUKBzs6ke3e4yZsb', 'PtHQpgJ4AP5nc3hMR60', 'JLyjwLJbcAMHG6upYU7', 'QB02xfJneRiQRDQdKK5'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, GdVpNdHph65Xr3MQNJ.cs High entropy of concatenated method names: 'CIOb1tuwt', 'zCmKNueKH', 'Q8CYN0H4H', 'd7ngXayTQ', 'Grn6EpXyK', 'QwEhrEywD', 'HCvgenGjCxLNupbv65', 'SZLaJHgtKYjYa9GdMJ', 'focITw3yq', 'BAcSL1APC'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, mg30r0LvvjO4WBi4Lq.cs High entropy of concatenated method names: 'ToString', 'EUyDow5BVR', 'h8uDA9It9u', 'QgRDPJAHEH', 'c1nDFZ1OL1', 'NbvDLrP91a', 'CEDDHNUGnf', 'hOqDGuKd1V', 'BkHDpwEMx1', 'r5SDlTQF7u'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, sjFY1MeLbRxNIpof7F.cs High entropy of concatenated method names: 'jigqBygbCY', 'tDhqaTgEcd', 'e1Qq8Gbl62', 'BauqsotPLY', 'iEYqibSLsi', 'iJWqD6IsUW', 'RVxmBlteOuB3LbryVq', 'uOG9mX8nWL8NtAnOXO', 'fr6qqx2D6J', 'UvrqMubBmA'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, Kgf4xNGn4VbYqvmk5H.cs High entropy of concatenated method names: 'Q8CrC6P9o0', 'zJXrOrc8De', 'JI9Iy95l6s', 'aqbIqiokhx', 'xJXroCNBqB', 'wLKr4Hjje2', 'ig9rJcuvPa', 'vfTr0I77LI', 'j4kr9NsNHH', 'yn0r1XY54L'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, lOsHXAsovXZfc94OB5.cs High entropy of concatenated method names: 'WktMU2cTbG', 'x5hM3yGQUM', 'gRpMwPZJe1', 'UPYMn1JRLN', 'LjlM2fgDtf', 'r2bMXgUbuY', 'Fr4MBT33D2', 'vBpMaqk9aq', 'ko9Mj8HQLZ', 'RyZM85rkTZ'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, LB6mXH10Ukg0a6Bg1Fb.cs High entropy of concatenated method names: 'eZDWZyXd0D', 'LLPWd6yhiJ', 'z2uWb2hBwt', 'amAWKJoZMP', 'swnWmeVjEy', 'opGWY2eX1r', 'VdrWgRdSPU', 'zAMWThCyys', 'CN1W6qRsLr', 'K2QWhBSeYO'
Source: 0.2.SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe.472b5f0.2.raw.unpack, OEUYs3ofI7bWQpg2kV.cs High entropy of concatenated method names: 'G4oI7WkAoK', 'syeIA30dth', 'TuFIP7hPlF', 'rcdIFo7Hij', 'A5MI0jyQnJ', 'vchILcbcKO', 'Next', 'Next', 'Next', 'NextBytes'

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe PID: 7320, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory allocated: 19F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory allocated: 33A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory allocated: 32E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory allocated: 8060000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory allocated: 9060000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory allocated: 9310000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory allocated: A310000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B096E rdtsc 3_2_019B096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7468 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2308 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe API coverage: 0.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe TID: 7340 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7628 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1736378320.0000000001645000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe, 00000000.00000002.1736378320.0000000001645000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B096E rdtsc 3_2_019B096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00417CC3 LdrLoadDll, 3_2_00417CC3
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F019F mov eax, dword ptr fs:[00000030h] 3_2_019F019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F019F mov eax, dword ptr fs:[00000030h] 3_2_019F019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F019F mov eax, dword ptr fs:[00000030h] 3_2_019F019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F019F mov eax, dword ptr fs:[00000030h] 3_2_019F019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196A197 mov eax, dword ptr fs:[00000030h] 3_2_0196A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196A197 mov eax, dword ptr fs:[00000030h] 3_2_0196A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196A197 mov eax, dword ptr fs:[00000030h] 3_2_0196A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B0185 mov eax, dword ptr fs:[00000030h] 3_2_019B0185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A14180 mov eax, dword ptr fs:[00000030h] 3_2_01A14180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A14180 mov eax, dword ptr fs:[00000030h] 3_2_01A14180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A2C188 mov eax, dword ptr fs:[00000030h] 3_2_01A2C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A2C188 mov eax, dword ptr fs:[00000030h] 3_2_01A2C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A461E5 mov eax, dword ptr fs:[00000030h] 3_2_01A461E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EE1D0 mov eax, dword ptr fs:[00000030h] 3_2_019EE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EE1D0 mov eax, dword ptr fs:[00000030h] 3_2_019EE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EE1D0 mov ecx, dword ptr fs:[00000030h] 3_2_019EE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EE1D0 mov eax, dword ptr fs:[00000030h] 3_2_019EE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EE1D0 mov eax, dword ptr fs:[00000030h] 3_2_019EE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A361C3 mov eax, dword ptr fs:[00000030h] 3_2_01A361C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A361C3 mov eax, dword ptr fs:[00000030h] 3_2_01A361C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A01F8 mov eax, dword ptr fs:[00000030h] 3_2_019A01F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E10E mov eax, dword ptr fs:[00000030h] 3_2_01A1E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E10E mov ecx, dword ptr fs:[00000030h] 3_2_01A1E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E10E mov eax, dword ptr fs:[00000030h] 3_2_01A1E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E10E mov eax, dword ptr fs:[00000030h] 3_2_01A1E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E10E mov ecx, dword ptr fs:[00000030h] 3_2_01A1E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E10E mov eax, dword ptr fs:[00000030h] 3_2_01A1E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E10E mov eax, dword ptr fs:[00000030h] 3_2_01A1E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E10E mov ecx, dword ptr fs:[00000030h] 3_2_01A1E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E10E mov eax, dword ptr fs:[00000030h] 3_2_01A1E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E10E mov ecx, dword ptr fs:[00000030h] 3_2_01A1E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A30115 mov eax, dword ptr fs:[00000030h] 3_2_01A30115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1A118 mov ecx, dword ptr fs:[00000030h] 3_2_01A1A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1A118 mov eax, dword ptr fs:[00000030h] 3_2_01A1A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1A118 mov eax, dword ptr fs:[00000030h] 3_2_01A1A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1A118 mov eax, dword ptr fs:[00000030h] 3_2_01A1A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A0124 mov eax, dword ptr fs:[00000030h] 3_2_019A0124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196C156 mov eax, dword ptr fs:[00000030h] 3_2_0196C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A44164 mov eax, dword ptr fs:[00000030h] 3_2_01A44164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A44164 mov eax, dword ptr fs:[00000030h] 3_2_01A44164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01976154 mov eax, dword ptr fs:[00000030h] 3_2_01976154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01976154 mov eax, dword ptr fs:[00000030h] 3_2_01976154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A04144 mov eax, dword ptr fs:[00000030h] 3_2_01A04144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A04144 mov eax, dword ptr fs:[00000030h] 3_2_01A04144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A04144 mov ecx, dword ptr fs:[00000030h] 3_2_01A04144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A04144 mov eax, dword ptr fs:[00000030h] 3_2_01A04144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A04144 mov eax, dword ptr fs:[00000030h] 3_2_01A04144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A08158 mov eax, dword ptr fs:[00000030h] 3_2_01A08158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A080A8 mov eax, dword ptr fs:[00000030h] 3_2_01A080A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A360B8 mov eax, dword ptr fs:[00000030h] 3_2_01A360B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A360B8 mov ecx, dword ptr fs:[00000030h] 3_2_01A360B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197208A mov eax, dword ptr fs:[00000030h] 3_2_0197208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019680A0 mov eax, dword ptr fs:[00000030h] 3_2_019680A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F20DE mov eax, dword ptr fs:[00000030h] 3_2_019F20DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196C0F0 mov eax, dword ptr fs:[00000030h] 3_2_0196C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B20F0 mov ecx, dword ptr fs:[00000030h] 3_2_019B20F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196A0E3 mov ecx, dword ptr fs:[00000030h] 3_2_0196A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019780E9 mov eax, dword ptr fs:[00000030h] 3_2_019780E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F60E0 mov eax, dword ptr fs:[00000030h] 3_2_019F60E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198E016 mov eax, dword ptr fs:[00000030h] 3_2_0198E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198E016 mov eax, dword ptr fs:[00000030h] 3_2_0198E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198E016 mov eax, dword ptr fs:[00000030h] 3_2_0198E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198E016 mov eax, dword ptr fs:[00000030h] 3_2_0198E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A06030 mov eax, dword ptr fs:[00000030h] 3_2_01A06030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F4000 mov ecx, dword ptr fs:[00000030h] 3_2_019F4000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A12000 mov eax, dword ptr fs:[00000030h] 3_2_01A12000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A12000 mov eax, dword ptr fs:[00000030h] 3_2_01A12000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A12000 mov eax, dword ptr fs:[00000030h] 3_2_01A12000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A12000 mov eax, dword ptr fs:[00000030h] 3_2_01A12000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A12000 mov eax, dword ptr fs:[00000030h] 3_2_01A12000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A12000 mov eax, dword ptr fs:[00000030h] 3_2_01A12000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A12000 mov eax, dword ptr fs:[00000030h] 3_2_01A12000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A12000 mov eax, dword ptr fs:[00000030h] 3_2_01A12000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196A020 mov eax, dword ptr fs:[00000030h] 3_2_0196A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196C020 mov eax, dword ptr fs:[00000030h] 3_2_0196C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01972050 mov eax, dword ptr fs:[00000030h] 3_2_01972050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F6050 mov eax, dword ptr fs:[00000030h] 3_2_019F6050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199C073 mov eax, dword ptr fs:[00000030h] 3_2_0199C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01968397 mov eax, dword ptr fs:[00000030h] 3_2_01968397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01968397 mov eax, dword ptr fs:[00000030h] 3_2_01968397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01968397 mov eax, dword ptr fs:[00000030h] 3_2_01968397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199438F mov eax, dword ptr fs:[00000030h] 3_2_0199438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199438F mov eax, dword ptr fs:[00000030h] 3_2_0199438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196E388 mov eax, dword ptr fs:[00000030h] 3_2_0196E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196E388 mov eax, dword ptr fs:[00000030h] 3_2_0196E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196E388 mov eax, dword ptr fs:[00000030h] 3_2_0196E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019783C0 mov eax, dword ptr fs:[00000030h] 3_2_019783C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019783C0 mov eax, dword ptr fs:[00000030h] 3_2_019783C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019783C0 mov eax, dword ptr fs:[00000030h] 3_2_019783C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019783C0 mov eax, dword ptr fs:[00000030h] 3_2_019783C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0197A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0197A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0197A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0197A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0197A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0197A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F63C0 mov eax, dword ptr fs:[00000030h] 3_2_019F63C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A63FF mov eax, dword ptr fs:[00000030h] 3_2_019A63FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198E3F0 mov eax, dword ptr fs:[00000030h] 3_2_0198E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198E3F0 mov eax, dword ptr fs:[00000030h] 3_2_0198E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198E3F0 mov eax, dword ptr fs:[00000030h] 3_2_0198E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A2C3CD mov eax, dword ptr fs:[00000030h] 3_2_01A2C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019803E9 mov eax, dword ptr fs:[00000030h] 3_2_019803E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019803E9 mov eax, dword ptr fs:[00000030h] 3_2_019803E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019803E9 mov eax, dword ptr fs:[00000030h] 3_2_019803E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019803E9 mov eax, dword ptr fs:[00000030h] 3_2_019803E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019803E9 mov eax, dword ptr fs:[00000030h] 3_2_019803E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019803E9 mov eax, dword ptr fs:[00000030h] 3_2_019803E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019803E9 mov eax, dword ptr fs:[00000030h] 3_2_019803E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019803E9 mov eax, dword ptr fs:[00000030h] 3_2_019803E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A143D4 mov eax, dword ptr fs:[00000030h] 3_2_01A143D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A143D4 mov eax, dword ptr fs:[00000030h] 3_2_01A143D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E3DB mov eax, dword ptr fs:[00000030h] 3_2_01A1E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E3DB mov eax, dword ptr fs:[00000030h] 3_2_01A1E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E3DB mov ecx, dword ptr fs:[00000030h] 3_2_01A1E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1E3DB mov eax, dword ptr fs:[00000030h] 3_2_01A1E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A48324 mov eax, dword ptr fs:[00000030h] 3_2_01A48324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A48324 mov ecx, dword ptr fs:[00000030h] 3_2_01A48324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A48324 mov eax, dword ptr fs:[00000030h] 3_2_01A48324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A48324 mov eax, dword ptr fs:[00000030h] 3_2_01A48324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196C310 mov ecx, dword ptr fs:[00000030h] 3_2_0196C310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01990310 mov ecx, dword ptr fs:[00000030h] 3_2_01990310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AA30B mov eax, dword ptr fs:[00000030h] 3_2_019AA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AA30B mov eax, dword ptr fs:[00000030h] 3_2_019AA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AA30B mov eax, dword ptr fs:[00000030h] 3_2_019AA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F035C mov eax, dword ptr fs:[00000030h] 3_2_019F035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F035C mov eax, dword ptr fs:[00000030h] 3_2_019F035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F035C mov eax, dword ptr fs:[00000030h] 3_2_019F035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F035C mov ecx, dword ptr fs:[00000030h] 3_2_019F035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F035C mov eax, dword ptr fs:[00000030h] 3_2_019F035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F035C mov eax, dword ptr fs:[00000030h] 3_2_019F035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F2349 mov eax, dword ptr fs:[00000030h] 3_2_019F2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1437C mov eax, dword ptr fs:[00000030h] 3_2_01A1437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A4634F mov eax, dword ptr fs:[00000030h] 3_2_01A4634F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3A352 mov eax, dword ptr fs:[00000030h] 3_2_01A3A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A18350 mov ecx, dword ptr fs:[00000030h] 3_2_01A18350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A062A0 mov eax, dword ptr fs:[00000030h] 3_2_01A062A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A062A0 mov ecx, dword ptr fs:[00000030h] 3_2_01A062A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A062A0 mov eax, dword ptr fs:[00000030h] 3_2_01A062A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A062A0 mov eax, dword ptr fs:[00000030h] 3_2_01A062A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A062A0 mov eax, dword ptr fs:[00000030h] 3_2_01A062A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A062A0 mov eax, dword ptr fs:[00000030h] 3_2_01A062A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F0283 mov eax, dword ptr fs:[00000030h] 3_2_019F0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F0283 mov eax, dword ptr fs:[00000030h] 3_2_019F0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F0283 mov eax, dword ptr fs:[00000030h] 3_2_019F0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE284 mov eax, dword ptr fs:[00000030h] 3_2_019AE284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE284 mov eax, dword ptr fs:[00000030h] 3_2_019AE284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019802A0 mov eax, dword ptr fs:[00000030h] 3_2_019802A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019802A0 mov eax, dword ptr fs:[00000030h] 3_2_019802A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0197A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0197A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0197A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0197A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0197A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A462D6 mov eax, dword ptr fs:[00000030h] 3_2_01A462D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019802E1 mov eax, dword ptr fs:[00000030h] 3_2_019802E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019802E1 mov eax, dword ptr fs:[00000030h] 3_2_019802E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019802E1 mov eax, dword ptr fs:[00000030h] 3_2_019802E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196823B mov eax, dword ptr fs:[00000030h] 3_2_0196823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196A250 mov eax, dword ptr fs:[00000030h] 3_2_0196A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01976259 mov eax, dword ptr fs:[00000030h] 3_2_01976259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 mov eax, dword ptr fs:[00000030h] 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 mov eax, dword ptr fs:[00000030h] 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 mov eax, dword ptr fs:[00000030h] 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 mov eax, dword ptr fs:[00000030h] 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 mov eax, dword ptr fs:[00000030h] 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 mov eax, dword ptr fs:[00000030h] 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 mov eax, dword ptr fs:[00000030h] 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 mov eax, dword ptr fs:[00000030h] 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 mov eax, dword ptr fs:[00000030h] 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 mov eax, dword ptr fs:[00000030h] 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 mov eax, dword ptr fs:[00000030h] 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A20274 mov eax, dword ptr fs:[00000030h] 3_2_01A20274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F8243 mov eax, dword ptr fs:[00000030h] 3_2_019F8243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F8243 mov ecx, dword ptr fs:[00000030h] 3_2_019F8243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A2A250 mov eax, dword ptr fs:[00000030h] 3_2_01A2A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A2A250 mov eax, dword ptr fs:[00000030h] 3_2_01A2A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01974260 mov eax, dword ptr fs:[00000030h] 3_2_01974260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01974260 mov eax, dword ptr fs:[00000030h] 3_2_01974260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01974260 mov eax, dword ptr fs:[00000030h] 3_2_01974260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A4625D mov eax, dword ptr fs:[00000030h] 3_2_01A4625D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196826B mov eax, dword ptr fs:[00000030h] 3_2_0196826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE59C mov eax, dword ptr fs:[00000030h] 3_2_019AE59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A4588 mov eax, dword ptr fs:[00000030h] 3_2_019A4588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01972582 mov eax, dword ptr fs:[00000030h] 3_2_01972582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01972582 mov ecx, dword ptr fs:[00000030h] 3_2_01972582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019945B1 mov eax, dword ptr fs:[00000030h] 3_2_019945B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019945B1 mov eax, dword ptr fs:[00000030h] 3_2_019945B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F05A7 mov eax, dword ptr fs:[00000030h] 3_2_019F05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F05A7 mov eax, dword ptr fs:[00000030h] 3_2_019F05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F05A7 mov eax, dword ptr fs:[00000030h] 3_2_019F05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019765D0 mov eax, dword ptr fs:[00000030h] 3_2_019765D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AA5D0 mov eax, dword ptr fs:[00000030h] 3_2_019AA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AA5D0 mov eax, dword ptr fs:[00000030h] 3_2_019AA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE5CF mov eax, dword ptr fs:[00000030h] 3_2_019AE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE5CF mov eax, dword ptr fs:[00000030h] 3_2_019AE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019725E0 mov eax, dword ptr fs:[00000030h] 3_2_019725E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AC5ED mov eax, dword ptr fs:[00000030h] 3_2_019AC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AC5ED mov eax, dword ptr fs:[00000030h] 3_2_019AC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0199E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0199E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0199E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0199E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0199E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0199E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0199E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0199E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A06500 mov eax, dword ptr fs:[00000030h] 3_2_01A06500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A44500 mov eax, dword ptr fs:[00000030h] 3_2_01A44500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A44500 mov eax, dword ptr fs:[00000030h] 3_2_01A44500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A44500 mov eax, dword ptr fs:[00000030h] 3_2_01A44500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A44500 mov eax, dword ptr fs:[00000030h] 3_2_01A44500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A44500 mov eax, dword ptr fs:[00000030h] 3_2_01A44500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A44500 mov eax, dword ptr fs:[00000030h] 3_2_01A44500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A44500 mov eax, dword ptr fs:[00000030h] 3_2_01A44500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E53E mov eax, dword ptr fs:[00000030h] 3_2_0199E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E53E mov eax, dword ptr fs:[00000030h] 3_2_0199E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E53E mov eax, dword ptr fs:[00000030h] 3_2_0199E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E53E mov eax, dword ptr fs:[00000030h] 3_2_0199E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E53E mov eax, dword ptr fs:[00000030h] 3_2_0199E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980535 mov eax, dword ptr fs:[00000030h] 3_2_01980535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980535 mov eax, dword ptr fs:[00000030h] 3_2_01980535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980535 mov eax, dword ptr fs:[00000030h] 3_2_01980535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980535 mov eax, dword ptr fs:[00000030h] 3_2_01980535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980535 mov eax, dword ptr fs:[00000030h] 3_2_01980535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980535 mov eax, dword ptr fs:[00000030h] 3_2_01980535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01978550 mov eax, dword ptr fs:[00000030h] 3_2_01978550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01978550 mov eax, dword ptr fs:[00000030h] 3_2_01978550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A656A mov eax, dword ptr fs:[00000030h] 3_2_019A656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A656A mov eax, dword ptr fs:[00000030h] 3_2_019A656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A656A mov eax, dword ptr fs:[00000030h] 3_2_019A656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A44B0 mov ecx, dword ptr fs:[00000030h] 3_2_019A44B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FA4B0 mov eax, dword ptr fs:[00000030h] 3_2_019FA4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A2A49A mov eax, dword ptr fs:[00000030h] 3_2_01A2A49A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019764AB mov eax, dword ptr fs:[00000030h] 3_2_019764AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019704E5 mov ecx, dword ptr fs:[00000030h] 3_2_019704E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A8402 mov eax, dword ptr fs:[00000030h] 3_2_019A8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A8402 mov eax, dword ptr fs:[00000030h] 3_2_019A8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A8402 mov eax, dword ptr fs:[00000030h] 3_2_019A8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AA430 mov eax, dword ptr fs:[00000030h] 3_2_019AA430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196C427 mov eax, dword ptr fs:[00000030h] 3_2_0196C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196E420 mov eax, dword ptr fs:[00000030h] 3_2_0196E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196E420 mov eax, dword ptr fs:[00000030h] 3_2_0196E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196E420 mov eax, dword ptr fs:[00000030h] 3_2_0196E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F6420 mov eax, dword ptr fs:[00000030h] 3_2_019F6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F6420 mov eax, dword ptr fs:[00000030h] 3_2_019F6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F6420 mov eax, dword ptr fs:[00000030h] 3_2_019F6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F6420 mov eax, dword ptr fs:[00000030h] 3_2_019F6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F6420 mov eax, dword ptr fs:[00000030h] 3_2_019F6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F6420 mov eax, dword ptr fs:[00000030h] 3_2_019F6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F6420 mov eax, dword ptr fs:[00000030h] 3_2_019F6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199245A mov eax, dword ptr fs:[00000030h] 3_2_0199245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196645D mov eax, dword ptr fs:[00000030h] 3_2_0196645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE443 mov eax, dword ptr fs:[00000030h] 3_2_019AE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE443 mov eax, dword ptr fs:[00000030h] 3_2_019AE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE443 mov eax, dword ptr fs:[00000030h] 3_2_019AE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE443 mov eax, dword ptr fs:[00000030h] 3_2_019AE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE443 mov eax, dword ptr fs:[00000030h] 3_2_019AE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE443 mov eax, dword ptr fs:[00000030h] 3_2_019AE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE443 mov eax, dword ptr fs:[00000030h] 3_2_019AE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AE443 mov eax, dword ptr fs:[00000030h] 3_2_019AE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199A470 mov eax, dword ptr fs:[00000030h] 3_2_0199A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199A470 mov eax, dword ptr fs:[00000030h] 3_2_0199A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199A470 mov eax, dword ptr fs:[00000030h] 3_2_0199A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A2A456 mov eax, dword ptr fs:[00000030h] 3_2_01A2A456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FC460 mov ecx, dword ptr fs:[00000030h] 3_2_019FC460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A247A0 mov eax, dword ptr fs:[00000030h] 3_2_01A247A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1678E mov eax, dword ptr fs:[00000030h] 3_2_01A1678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019707AF mov eax, dword ptr fs:[00000030h] 3_2_019707AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197C7C0 mov eax, dword ptr fs:[00000030h] 3_2_0197C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F07C3 mov eax, dword ptr fs:[00000030h] 3_2_019F07C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019747FB mov eax, dword ptr fs:[00000030h] 3_2_019747FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019747FB mov eax, dword ptr fs:[00000030h] 3_2_019747FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019927ED mov eax, dword ptr fs:[00000030h] 3_2_019927ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019927ED mov eax, dword ptr fs:[00000030h] 3_2_019927ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019927ED mov eax, dword ptr fs:[00000030h] 3_2_019927ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FE7E1 mov eax, dword ptr fs:[00000030h] 3_2_019FE7E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01970710 mov eax, dword ptr fs:[00000030h] 3_2_01970710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A0710 mov eax, dword ptr fs:[00000030h] 3_2_019A0710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AC700 mov eax, dword ptr fs:[00000030h] 3_2_019AC700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A273C mov eax, dword ptr fs:[00000030h] 3_2_019A273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A273C mov ecx, dword ptr fs:[00000030h] 3_2_019A273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A273C mov eax, dword ptr fs:[00000030h] 3_2_019A273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EC730 mov eax, dword ptr fs:[00000030h] 3_2_019EC730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AC720 mov eax, dword ptr fs:[00000030h] 3_2_019AC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AC720 mov eax, dword ptr fs:[00000030h] 3_2_019AC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FE75D mov eax, dword ptr fs:[00000030h] 3_2_019FE75D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01970750 mov eax, dword ptr fs:[00000030h] 3_2_01970750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F4755 mov eax, dword ptr fs:[00000030h] 3_2_019F4755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2750 mov eax, dword ptr fs:[00000030h] 3_2_019B2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2750 mov eax, dword ptr fs:[00000030h] 3_2_019B2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A674D mov esi, dword ptr fs:[00000030h] 3_2_019A674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A674D mov eax, dword ptr fs:[00000030h] 3_2_019A674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A674D mov eax, dword ptr fs:[00000030h] 3_2_019A674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01978770 mov eax, dword ptr fs:[00000030h] 3_2_01978770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 mov eax, dword ptr fs:[00000030h] 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 mov eax, dword ptr fs:[00000030h] 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 mov eax, dword ptr fs:[00000030h] 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 mov eax, dword ptr fs:[00000030h] 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 mov eax, dword ptr fs:[00000030h] 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 mov eax, dword ptr fs:[00000030h] 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 mov eax, dword ptr fs:[00000030h] 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 mov eax, dword ptr fs:[00000030h] 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 mov eax, dword ptr fs:[00000030h] 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 mov eax, dword ptr fs:[00000030h] 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 mov eax, dword ptr fs:[00000030h] 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980770 mov eax, dword ptr fs:[00000030h] 3_2_01980770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01974690 mov eax, dword ptr fs:[00000030h] 3_2_01974690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01974690 mov eax, dword ptr fs:[00000030h] 3_2_01974690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A66B0 mov eax, dword ptr fs:[00000030h] 3_2_019A66B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AC6A6 mov eax, dword ptr fs:[00000030h] 3_2_019AC6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AA6C7 mov ebx, dword ptr fs:[00000030h] 3_2_019AA6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AA6C7 mov eax, dword ptr fs:[00000030h] 3_2_019AA6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EE6F2 mov eax, dword ptr fs:[00000030h] 3_2_019EE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EE6F2 mov eax, dword ptr fs:[00000030h] 3_2_019EE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EE6F2 mov eax, dword ptr fs:[00000030h] 3_2_019EE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EE6F2 mov eax, dword ptr fs:[00000030h] 3_2_019EE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F06F1 mov eax, dword ptr fs:[00000030h] 3_2_019F06F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F06F1 mov eax, dword ptr fs:[00000030h] 3_2_019F06F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B2619 mov eax, dword ptr fs:[00000030h] 3_2_019B2619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198260B mov eax, dword ptr fs:[00000030h] 3_2_0198260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198260B mov eax, dword ptr fs:[00000030h] 3_2_0198260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198260B mov eax, dword ptr fs:[00000030h] 3_2_0198260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198260B mov eax, dword ptr fs:[00000030h] 3_2_0198260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198260B mov eax, dword ptr fs:[00000030h] 3_2_0198260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198260B mov eax, dword ptr fs:[00000030h] 3_2_0198260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198260B mov eax, dword ptr fs:[00000030h] 3_2_0198260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EE609 mov eax, dword ptr fs:[00000030h] 3_2_019EE609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A6620 mov eax, dword ptr fs:[00000030h] 3_2_019A6620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A8620 mov eax, dword ptr fs:[00000030h] 3_2_019A8620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197262C mov eax, dword ptr fs:[00000030h] 3_2_0197262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198E627 mov eax, dword ptr fs:[00000030h] 3_2_0198E627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3866E mov eax, dword ptr fs:[00000030h] 3_2_01A3866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3866E mov eax, dword ptr fs:[00000030h] 3_2_01A3866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0198C640 mov eax, dword ptr fs:[00000030h] 3_2_0198C640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A2674 mov eax, dword ptr fs:[00000030h] 3_2_019A2674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AA660 mov eax, dword ptr fs:[00000030h] 3_2_019AA660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AA660 mov eax, dword ptr fs:[00000030h] 3_2_019AA660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F89B3 mov esi, dword ptr fs:[00000030h] 3_2_019F89B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F89B3 mov eax, dword ptr fs:[00000030h] 3_2_019F89B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F89B3 mov eax, dword ptr fs:[00000030h] 3_2_019F89B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019829A0 mov eax, dword ptr fs:[00000030h] 3_2_019829A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019709AD mov eax, dword ptr fs:[00000030h] 3_2_019709AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019709AD mov eax, dword ptr fs:[00000030h] 3_2_019709AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0197A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0197A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0197A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0197A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0197A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0197A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A49D0 mov eax, dword ptr fs:[00000030h] 3_2_019A49D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A069C0 mov eax, dword ptr fs:[00000030h] 3_2_01A069C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A29F9 mov eax, dword ptr fs:[00000030h] 3_2_019A29F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A29F9 mov eax, dword ptr fs:[00000030h] 3_2_019A29F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3A9D3 mov eax, dword ptr fs:[00000030h] 3_2_01A3A9D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FE9E0 mov eax, dword ptr fs:[00000030h] 3_2_019FE9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A0892B mov eax, dword ptr fs:[00000030h] 3_2_01A0892B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FC912 mov eax, dword ptr fs:[00000030h] 3_2_019FC912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01968918 mov eax, dword ptr fs:[00000030h] 3_2_01968918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01968918 mov eax, dword ptr fs:[00000030h] 3_2_01968918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EE908 mov eax, dword ptr fs:[00000030h] 3_2_019EE908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EE908 mov eax, dword ptr fs:[00000030h] 3_2_019EE908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F892A mov eax, dword ptr fs:[00000030h] 3_2_019F892A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019F0946 mov eax, dword ptr fs:[00000030h] 3_2_019F0946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A14978 mov eax, dword ptr fs:[00000030h] 3_2_01A14978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A14978 mov eax, dword ptr fs:[00000030h] 3_2_01A14978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FC97C mov eax, dword ptr fs:[00000030h] 3_2_019FC97C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A44940 mov eax, dword ptr fs:[00000030h] 3_2_01A44940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B096E mov eax, dword ptr fs:[00000030h] 3_2_019B096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B096E mov edx, dword ptr fs:[00000030h] 3_2_019B096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019B096E mov eax, dword ptr fs:[00000030h] 3_2_019B096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01996962 mov eax, dword ptr fs:[00000030h] 3_2_01996962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01996962 mov eax, dword ptr fs:[00000030h] 3_2_01996962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01996962 mov eax, dword ptr fs:[00000030h] 3_2_01996962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FC89D mov eax, dword ptr fs:[00000030h] 3_2_019FC89D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01970887 mov eax, dword ptr fs:[00000030h] 3_2_01970887
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3A8E4 mov eax, dword ptr fs:[00000030h] 3_2_01A3A8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199E8C0 mov eax, dword ptr fs:[00000030h] 3_2_0199E8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AC8F9 mov eax, dword ptr fs:[00000030h] 3_2_019AC8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AC8F9 mov eax, dword ptr fs:[00000030h] 3_2_019AC8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A408C0 mov eax, dword ptr fs:[00000030h] 3_2_01A408C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FC810 mov eax, dword ptr fs:[00000030h] 3_2_019FC810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1483A mov eax, dword ptr fs:[00000030h] 3_2_01A1483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1483A mov eax, dword ptr fs:[00000030h] 3_2_01A1483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AA830 mov eax, dword ptr fs:[00000030h] 3_2_019AA830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01992835 mov eax, dword ptr fs:[00000030h] 3_2_01992835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01992835 mov eax, dword ptr fs:[00000030h] 3_2_01992835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01992835 mov eax, dword ptr fs:[00000030h] 3_2_01992835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01992835 mov ecx, dword ptr fs:[00000030h] 3_2_01992835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01992835 mov eax, dword ptr fs:[00000030h] 3_2_01992835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01992835 mov eax, dword ptr fs:[00000030h] 3_2_01992835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01974859 mov eax, dword ptr fs:[00000030h] 3_2_01974859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01974859 mov eax, dword ptr fs:[00000030h] 3_2_01974859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A0854 mov eax, dword ptr fs:[00000030h] 3_2_019A0854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A06870 mov eax, dword ptr fs:[00000030h] 3_2_01A06870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A06870 mov eax, dword ptr fs:[00000030h] 3_2_01A06870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01982840 mov ecx, dword ptr fs:[00000030h] 3_2_01982840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FE872 mov eax, dword ptr fs:[00000030h] 3_2_019FE872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FE872 mov eax, dword ptr fs:[00000030h] 3_2_019FE872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A24BB0 mov eax, dword ptr fs:[00000030h] 3_2_01A24BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A24BB0 mov eax, dword ptr fs:[00000030h] 3_2_01A24BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980BBE mov eax, dword ptr fs:[00000030h] 3_2_01980BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980BBE mov eax, dword ptr fs:[00000030h] 3_2_01980BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01990BCB mov eax, dword ptr fs:[00000030h] 3_2_01990BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01990BCB mov eax, dword ptr fs:[00000030h] 3_2_01990BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01990BCB mov eax, dword ptr fs:[00000030h] 3_2_01990BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01970BCD mov eax, dword ptr fs:[00000030h] 3_2_01970BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01970BCD mov eax, dword ptr fs:[00000030h] 3_2_01970BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01970BCD mov eax, dword ptr fs:[00000030h] 3_2_01970BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199EBFC mov eax, dword ptr fs:[00000030h] 3_2_0199EBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01978BF0 mov eax, dword ptr fs:[00000030h] 3_2_01978BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01978BF0 mov eax, dword ptr fs:[00000030h] 3_2_01978BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01978BF0 mov eax, dword ptr fs:[00000030h] 3_2_01978BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FCBF0 mov eax, dword ptr fs:[00000030h] 3_2_019FCBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1EBD0 mov eax, dword ptr fs:[00000030h] 3_2_01A1EBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EEB1D mov eax, dword ptr fs:[00000030h] 3_2_019EEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EEB1D mov eax, dword ptr fs:[00000030h] 3_2_019EEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EEB1D mov eax, dword ptr fs:[00000030h] 3_2_019EEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EEB1D mov eax, dword ptr fs:[00000030h] 3_2_019EEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EEB1D mov eax, dword ptr fs:[00000030h] 3_2_019EEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EEB1D mov eax, dword ptr fs:[00000030h] 3_2_019EEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EEB1D mov eax, dword ptr fs:[00000030h] 3_2_019EEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EEB1D mov eax, dword ptr fs:[00000030h] 3_2_019EEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019EEB1D mov eax, dword ptr fs:[00000030h] 3_2_019EEB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A38B28 mov eax, dword ptr fs:[00000030h] 3_2_01A38B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A38B28 mov eax, dword ptr fs:[00000030h] 3_2_01A38B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A44B00 mov eax, dword ptr fs:[00000030h] 3_2_01A44B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199EB20 mov eax, dword ptr fs:[00000030h] 3_2_0199EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199EB20 mov eax, dword ptr fs:[00000030h] 3_2_0199EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01968B50 mov eax, dword ptr fs:[00000030h] 3_2_01968B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A06B40 mov eax, dword ptr fs:[00000030h] 3_2_01A06B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A06B40 mov eax, dword ptr fs:[00000030h] 3_2_01A06B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A3AB40 mov eax, dword ptr fs:[00000030h] 3_2_01A3AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A18B42 mov eax, dword ptr fs:[00000030h] 3_2_01A18B42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0196CB7E mov eax, dword ptr fs:[00000030h] 3_2_0196CB7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A24B4B mov eax, dword ptr fs:[00000030h] 3_2_01A24B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A24B4B mov eax, dword ptr fs:[00000030h] 3_2_01A24B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1EB50 mov eax, dword ptr fs:[00000030h] 3_2_01A1EB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A42B57 mov eax, dword ptr fs:[00000030h] 3_2_01A42B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A42B57 mov eax, dword ptr fs:[00000030h] 3_2_01A42B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A42B57 mov eax, dword ptr fs:[00000030h] 3_2_01A42B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A42B57 mov eax, dword ptr fs:[00000030h] 3_2_01A42B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A8A90 mov edx, dword ptr fs:[00000030h] 3_2_019A8A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197EA80 mov eax, dword ptr fs:[00000030h] 3_2_0197EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197EA80 mov eax, dword ptr fs:[00000030h] 3_2_0197EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197EA80 mov eax, dword ptr fs:[00000030h] 3_2_0197EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197EA80 mov eax, dword ptr fs:[00000030h] 3_2_0197EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197EA80 mov eax, dword ptr fs:[00000030h] 3_2_0197EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197EA80 mov eax, dword ptr fs:[00000030h] 3_2_0197EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197EA80 mov eax, dword ptr fs:[00000030h] 3_2_0197EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197EA80 mov eax, dword ptr fs:[00000030h] 3_2_0197EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0197EA80 mov eax, dword ptr fs:[00000030h] 3_2_0197EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A44A80 mov eax, dword ptr fs:[00000030h] 3_2_01A44A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01978AA0 mov eax, dword ptr fs:[00000030h] 3_2_01978AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01978AA0 mov eax, dword ptr fs:[00000030h] 3_2_01978AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019C6AA4 mov eax, dword ptr fs:[00000030h] 3_2_019C6AA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01970AD0 mov eax, dword ptr fs:[00000030h] 3_2_01970AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A4AD0 mov eax, dword ptr fs:[00000030h] 3_2_019A4AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019A4AD0 mov eax, dword ptr fs:[00000030h] 3_2_019A4AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019C6ACC mov eax, dword ptr fs:[00000030h] 3_2_019C6ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019C6ACC mov eax, dword ptr fs:[00000030h] 3_2_019C6ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019C6ACC mov eax, dword ptr fs:[00000030h] 3_2_019C6ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AAAEE mov eax, dword ptr fs:[00000030h] 3_2_019AAAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019AAAEE mov eax, dword ptr fs:[00000030h] 3_2_019AAAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019FCA11 mov eax, dword ptr fs:[00000030h] 3_2_019FCA11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019ACA38 mov eax, dword ptr fs:[00000030h] 3_2_019ACA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01994A35 mov eax, dword ptr fs:[00000030h] 3_2_01994A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01994A35 mov eax, dword ptr fs:[00000030h] 3_2_01994A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0199EA2E mov eax, dword ptr fs:[00000030h] 3_2_0199EA2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_019ACA24 mov eax, dword ptr fs:[00000030h] 3_2_019ACA24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01A1EA60 mov eax, dword ptr fs:[00000030h] 3_2_01A1EA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980A5B mov eax, dword ptr fs:[00000030h] 3_2_01980A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01980A5B mov eax, dword ptr fs:[00000030h] 3_2_01980A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01976A50 mov eax, dword ptr fs:[00000030h] 3_2_01976A50
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe" Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 11E9008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.1951644033.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1952219358.0000000001840000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.1951644033.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1952219358.0000000001840000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1482798 Sample: SecuriteInfo.com.W32.Trojan... Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 22 Malicious sample detected (through community Yara rule) 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected FormBook 2->26 28 6 other signatures 2->28 7 SecuriteInfo.com.W32.Trojan.SW.gen.Eldorado.19987.15855.exe 4 2->7         started        process3 file4 20 SecuriteInfo.com.W...19987.15855.exe.log, ASCII 7->20 dropped 30 Writes to foreign memory regions 7->30 32 Allocates memory in foreign processes 7->32 34 Adds a directory exclusion to Windows Defender 7->34 36 Injects a PE file into a foreign processes 7->36 11 powershell.exe 23 7->11         started        14 RegSvcs.exe 7->14         started        signatures5 process6 signatures7 38 Loading BitLocker PowerShell Module 11->38 16 WmiPrvSE.exe 11->16         started        18 conhost.exe 11->18         started        process8
⊘No contacted IP infos